Make the publish decision explicit per document. `docs/wiki-pages.yml` is the
in-repo manifest — allowlist by default, carrying the exclusions — so the set
that reaches the wiki lives in the repo, not in the sync.

The mapping is recorded there: docs index -> Home, architecture,
runbooks index/page, decisions index/page, actions index and the glossary,
with `docs/agents/` excluded. Page names are flat and use only letters, digits
and `-`, matching Forgejo's wiki (no nested pages). Mirror semantics are
preserved: a page exists only while its source is listed.

`tests/check-wiki-pages.py` is the forcing function: every markdown document
in the docs tree (plus the glossary) must be published or excluded, and every
manifest entry must name a source that exists and a well-formed page name.
It reads the manifest with the same parser the sync will use (PyYAML, which
Ansible already brings), so the gate cannot silently disagree with its
consumer. It passes when covered and fails on a new, renamed, moved or deleted
document — so changing the docs forces a publish decision. No sync, hook,
workflow or role change: the sync that reads the manifest is the wiki-sync
work (#2).

Part of #7.

@@ -21,3 +21,7 @@ here.
 - Every relative link resolves inside the repo. Nothing here links out to the
   README, and the README does not link in here yet.
 - The glossary is a glossary: definitions only, no procedures.
+- What reaches the wiki is decided here, not in the sync: `wiki-pages.yml`

@@ -0,0 +6,4 @@
+# has to land a matching change here. The manifest lives in the repo, not in
+# the sync, so a human edits the decision and the sync reads it.
+#
+# The sync that consumes this file is the wiki-sync work (issue #2); nothing

@@ -0,0 +20,4 @@
+# gone is simply absent, with no per-file removal to remember.
+
+publish:
+  docs/index.md: Home