ci: point docs-verify at the live v4-0-0 tree, untag illustrative blocks (#3043)

* ci: point docs-verify at the live v4-0-0 tree, untag illustrative blocks

The workflow's path triggers still referenced v4-0-0-snapshot/**, deleted
at the GA rename (4a62207) — live-tree doc edits could never fire the
verify job. Point both path filters at the live tree and its sidebar.
The verify step keeps continue-on-error: true until issue #3041 (the
compile driver needs a framework-context fixture path; 312 live blocks
currently fail on missing context, not content) — this change buys
advisory visibility, not gating.

Also remove {test:compile} from the six blocks titled illustrative
(coding-standards.mdx x5, authentication-patterns.mdx x1) per the
tagging policy in writing-docs.mdx: anything that cannot compile gets
the illustrative title INSTEAD of a test tag.

Refs #3041

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Peter Amiri <peter@alurium.com>

* ci: trust the wheels tap before install — Homebrew 5.1+ gates third-party formulae

The workflow's dormancy hid this second rot layer: while the trigger
paths pointed at the deleted snapshot tree, Homebrew shipped formula
trust gating, so the first re-armed run failed at brew install with
'Refusing to load formula ... from untrusted tap'. brew trust is a
no-op guarded with || true on older brew versions.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Peter Amiri <peter@alurium.com>

* ci: disable Homebrew Linux sandbox on the runner — no rootless bwrap available

Dormancy rot layer three: Homebrew 5.x's Linux sandbox requires
Bubblewrap, absent on ubuntu-latest (and unreliable there even when
installed, given 24.04's unprivileged-userns restrictions). The
ephemeral CI runner is already isolation enough; HOMEBREW_NO_SANDBOX_LINUX
is the documented opt-out.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Peter Amiri <peter@alurium.com>

---------

Signed-off-by: Peter Amiri <peter@alurium.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: bpamiri

.github/workflows/docs-verify.yml

@@ -4,10 +4,10 @@ on:
   pull_request:
     branches: [develop]
     paths:
-      - 'web/sites/guides/src/content/docs/v4-0-0-snapshot/**'
+      - 'web/sites/guides/src/content/docs/v4-0-0/**'
       - 'web/sites/guides/scripts/verify-docs/**'
       - 'web/sites/guides/package.json'
-      - 'web/sites/guides/src/sidebars/v4-0-0-snapshot.json'
+      - 'web/sites/guides/src/sidebars/v4-0-0.json'
       - '.github/workflows/docs-verify.yml'
 
 jobs:
@@ -45,8 +45,17 @@ jobs:
         uses: Homebrew/actions/setup-homebrew@master
 
       - name: Install Wheels CLI
+        env:
+          # Homebrew 5.x's Linux sandbox needs a rootless bwrap, which
+          # ubuntu-latest runners don't provide (and 24.04's unprivileged
+          # userns restrictions make it unreliable even when installed).
+          # The ephemeral runner is already isolation enough for CI.
+          HOMEBREW_NO_SANDBOX_LINUX: "1"
         run: |
           brew tap wheels-dev/wheels || true
+          # Homebrew 5.1+ refuses to load formulae from untrusted third-party
+          # taps; trust must be granted explicitly (no-op on older brew).
+          brew trust wheels-dev/wheels || true
           brew install wheels
 
       - name: Patch wheels wrapper JAVA_HOME for Linux

web/sites/guides/src/content/docs/v4-0-0/contributing/coding-standards.mdx

@@ -78,7 +78,7 @@ These come directly from `.ai/wheels/cross-engine-compatibility.md` and are the
 
 Both engines resolve `obj.map()` as the built-in struct member function, not your CFC's `map()` method. The DI container exposes `mapInstance()` as the engine-safe alias.
 
-```cfm title="illustrative — do not type" {test:compile}
+```cfm title="illustrative — do not type"
 // WRONG — triggers struct.map(callback) on Lucee/Adobe
 arguments.container.map("myService").to("path").asSingleton();
 
@@ -90,7 +90,7 @@ arguments.container.mapInstance("myService").to("path").asSingleton();
 
 Adobe's `application` scope is Java-backed and loses function members across requests. Pass a plain struct context instead of mutating `application` directly.
 
-```cfm title="illustrative — do not type" {test:compile}
+```cfm title="illustrative — do not type"
 // WRONG — works on Lucee, breaks on Adobe
 application.registerMiddleware = function() { return true; };
 
@@ -103,7 +103,7 @@ context.registerMiddleware = function() { return true; };
 
 A closure binds `this` to where it is defined, not where it is assigned. Test code that dynamically attaches methods to a controller will call back into the spec, not the controller.
 
-```cfm title="illustrative — do not type" {test:compile}
+```cfm title="illustrative — do not type"
 // WRONG — this.renderText() runs on the test spec
 _controller.myAction = function() {
     this.renderText("hello");
@@ -120,7 +120,7 @@ _controller.myAction = function() {
 
 Split the lookup and the call.
 
-```cfm title="illustrative — do not type" {test:compile}
+```cfm title="illustrative — do not type"
 // WRONG — crashes Adobe CF 2021/2023 parser inside closures
 var result = obj["dynamicMethod"]();
 
@@ -133,7 +133,7 @@ var result = fn();
 
 `{arr: myArray}` duplicates the array on Adobe. Closures that append to the copy never touch the original. Reference through a parent struct.
 
-```cfm title="illustrative — do not type" {test:compile}
+```cfm title="illustrative — do not type"
 // WRONG — Adobe copies myArray into the struct
 var config = {arr: myArray};
 

web/sites/guides/src/content/docs/v4-0-0/digging-deeper/authentication-patterns.mdx

@@ -209,7 +209,7 @@ The callback receives the extracted token string and returns a principal struct
 
 ### Static token map (tests, seeded keys)
 
-```cfm {test:compile} title="illustrative — static tokens"
+```cfm title="illustrative — static tokens"
 var tokenStrategy = new wheels.auth.TokenStrategy(tokens={
     "dev-key-alice": {id: 1, role: "admin"},
     "dev-key-bob":   {id: 2, role: "reader"}