ci: run the Postgres suites that never ran and lint the shell (#6917)

Eight Postgres-only tests skipped everywhere because no workflow named
them. The durable-first job now runs the service and outbound ones, and a
scratch-database job runs the migration tests that drop their own tables.
Every Postgres step counts top-level passes, so a renamed test cannot
leave a step green.

A shell-lint job runs actionlint on the workflows and shellcheck on the
shipped scripts (the legacy installers at error severity), golangci-lint
is pinned, and both the codegen job and make verify fail when
docs/public/openapi.json drifts from the panel's spec; docs-ci also fails
on a stale API reference. npm audit moves to its own script outside make
verify, since it depends on the network.

.github/workflows/docs-ci.yml

@@ -5,10 +5,14 @@ on:
     branches: [main]
     paths:
       - 'docs/**'
+      - 'frontend/public/openapi.json'
+      - 'frontend/src/pages/api-docs/endpoints.ts'
       - '.github/workflows/docs-ci.yml'
   pull_request:
     paths:
       - 'docs/**'
+      - 'frontend/public/openapi.json'
+      - 'frontend/src/pages/api-docs/endpoints.ts'
       - '.github/workflows/docs-ci.yml'
 
 permissions:
@@ -48,5 +52,18 @@ jobs:
       - name: Test
         run: pnpm test
 
+      # The API reference is generated from the panel's own spec. The copy into
+      # docs/public and the generated pages both have to be in step with it.
+      - name: The docs spec must be the panel's
+        run: cmp frontend/public/openapi.json docs/public/openapi.json
+        working-directory: .
+
+      - name: Regenerate the API reference
+        run: pnpm gen:api
+
+      - name: Fail if the generated API reference is stale
+        run: git diff --exit-code -- docs/content/docs/en/reference/api
+        working-directory: .
+
       - name: Build
         run: pnpm build