Add markdownlint CI job and fix broken doc links

.github/workflows/ci.yml

@@ -19,6 +19,13 @@ jobs:
           terraform_wrapper: false
       - run: terraform fmt -check -recursive -diff
 
+  markdownlint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      # Globs and rules come from .markdownlint-cli2.yaml in the repo root.
+      - uses: DavidAnson/markdownlint-cli2-action@v23
+
   validate:
     runs-on: ubuntu-latest
     strategy:

.markdownlint-cli2.yaml

@@ -0,0 +1,20 @@
+# markdownlint-cli2 configuration. See https://github.com/DavidAnson/markdownlint
+# for the full rule reference.
+config:
+  # Line length: prose, tables, and long links routinely exceed any fixed width.
+  line-length: false
+  # Bold-as-heading: the docs deliberately use bold text as inline labels.
+  no-emphasis-as-heading: false
+  # Table pipe spacing: cosmetic; tables render correctly either way.
+  table-column-style: false
+  # Duplicate headings: the CHANGELOG repeats Added/Changed/Fixed per release,
+  # which is the Keep a Changelog convention. Only flag duplicates under the
+  # same parent heading.
+  no-duplicate-heading:
+    siblings_only: true
+# Lint top-level docs only; spec/ holds working notes and is intentionally
+# excluded. A non-recursive glob naturally skips spec/ and .github/. This
+# matches the default globs of markdownlint-cli2-action, so local runs and CI
+# lint the same files.
+globs:
+  - "*.{md,markdown}"

CHANGELOG.md

@@ -38,6 +38,7 @@ Optional release notice.
 ## [1.6.0] - 2026-02-24
 
 If you rely on the default `search_instance_type` / `search_dedicated_master_type`:
+
 - Upgrading from a version prior to 1.5.0 will fail on `terraform apply`. Upgrade to 1.5.0 first.
 - If you have reserved m5 instances, pin the instance types explicitly to keep using them.
 

OPERATIONS.md

@@ -12,20 +12,24 @@ This document provides comprehensive operational procedures for cloud teams mana
 
 ### Daily Checklist
 
-- [ ] Health check (5 min) - [Instructions](#daily-health-checks)
+- [ ] Health check (5 min) - [Instructions](#daily-health-checks-5-minutes)
 - [ ] Monitor alerts - [Dashboard Links](#monitoring-dashboards)
 - [ ] Review logs - [Log Locations](#log-management)
 
 ### Weekly Checklist
 
-- [ ] Backup verification (10 min) - [Instructions](#backup-verification)
-- [ ] Security updates (15 min) - [Instructions](#security-updates)
+- [ ] Backup verification (10 min) - [Instructions](#backup-verification-10-minutes)
+- [ ] Security updates (15 min) - [Instructions](#security-updates-15-minutes)
+<!-- TODO: no "Capacity review" section exists yet; see https://github.com/quiltdata/iac/issues/95 -->
+<!-- markdownlint-disable-next-line link-fragments -->
 - [ ] Capacity review (10 min) - [Instructions](#capacity-monitoring)
 
 ### Monthly Checklist
 
-- [ ] Capacity planning (20 min) - [Instructions](#capacity-planning)
-- [ ] Cost review (15 min) - [Instructions](#cost-optimization)
+- [ ] Capacity planning (20 min) - [Instructions](#capacity-planning-20-minutes)
+- [ ] Cost review (15 min) - [Instructions](#cost-optimization-recommendations)
+<!-- TODO: no "Security audit" section exists yet; see https://github.com/quiltdata/iac/issues/95 -->
+<!-- markdownlint-disable-next-line link-fragments -->
 - [ ] Security audit (30 min) - [Instructions](#security-audit)
 
 ## Installation Procedures