[Build] (CI): add the pipe-gen check, the stdio-instrumentation gate and the citation lint

- Three P0 gates from plan B section 11, in one job that needs no build: a broken build
  must not be able to hide a drifted interface.
- pipe-gen-check regenerates G1-G7 and runs git diff --exit-code over
  MobileGL/MG_Pipe/generated. Since all seven generators read the same .def files, this is
  what makes drift between them impossible rather than merely unlikely.
- The stdio gate refuses fprintf(stderr and printf( under MG_Backend and MG_State. Nothing
  there matches today, so it lands with NO whitelist - verified with a negative control
  that fprintf(stderr and std::printf both trip it while snprintf does not. Per-draw
  instrumentation has been committed by accident before, once inside a mutex critical
  section, and MGLOG_D is the channel these trees are allowed to use because it compiles
  out in INFO builds.
- scripts/gen_pipe_dirty_surface.py reports the frontend mutation surface corollary 4
  needs covered: 926 mutator calls under MG_Impl/GLImpl over 73 distinct mutators, of
  which only 92 sit in a function that also reaches the backend. The other 834 are
  published by the NEXT verb, which is precisely the population that needs an aggregate
  generation. Informational in P0; it becomes a gate in P1 when there is a mapping file to
  diff against.
- scripts/check_doc_citations.py resolves every `path:line` citation against a git
  revision. It reproduces the failure that motivated it - the plan's first draft cited
  SamplerObject.h:468-492 in a 160-line file - and reports 84 unresolved citations out of
  1028 in docs/Disaggregated today, which is why CI runs it warning-only until those
  documents settle. --strict exits 1, verified in both directions.

.github/workflows/test.yml

@@ -778,3 +778,55 @@ jobs:
           )
 
           echo "Deleted ${deleted} intermediate Linux artifact(s); retained ${retained} failed-retrace fixture(s)."
+
+  pipe-gates:
+    name: MGPipe generators and hygiene gates
+    runs-on: ubuntu-latest
+    # Deliberately independent of build-linux: these are source-level gates, they take
+    # seconds, and a broken build must not hide a drifted interface.
+
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v6
+
+      # The seven generators all read MG_Pipe/*.def, so regenerating and diffing is what
+      # keeps the two interface tables, the wire records, the verify comparators, the
+      # PipeInputs field ids, the read-inventory coverage and the render-state member list
+      # from drifting apart from the catalogue. The generated files are committed
+      # deliberately: the build must not depend on python.
+      - name: Regenerate the MGPipe interface (G1-G7)
+        run: |
+          python3 scripts/gen_pipe.py
+          git diff --exit-code -- MobileGL/MG_Pipe/generated
+
+      # Per-draw fprintf/printf instrumentation has repeatedly been committed by accident,
+      # once inside a mutex critical section. Nothing under these two trees prints to a
+      # stdio stream today - MGLOG_D compiles out in INFO builds and is the only channel
+      # they are allowed to use - so this gate starts with no exceptions, and any addition
+      # to it needs a reason in the pull request rather than a quiet whitelist entry.
+      - name: No stdio instrumentation in MG_Backend or MG_State
+        run: |
+          if grep -rnE 'fprintf[[:space:]]*\(stderr|(^|[^[:alnum:]_>.])printf[[:space:]]*\(' \
+              MobileGL/MG_Backend MobileGL/MG_State; then
+            echo "::error::stdio instrumentation found; use MGLOG_D (compiled out in INFO builds)"
+            exit 1
+          fi
+          echo "no fprintf(stderr / printf( under MobileGL/MG_Backend or MobileGL/MG_State"
+
+      # Informational: the frontend mutation surface an MGPipe aggregate generation has to
+      # cover. It becomes a gate in P1, when the mapping file exists to diff against.
+      - name: MGPipe dirty-surface report
+        run: python3 scripts/gen_pipe_dirty_surface.py --summary
+
+      # Warning only for now: the disaggregation documents are still being written, and a
+      # lint that fails a rewrite in progress teaches people to ignore it. It becomes
+      # --strict when the documents settle.
+      - name: Documentation citation lint
+        run: |
+          shopt -s nullglob
+          documents=(docs/Disaggregated/*.md)
+          if [ ${#documents[@]} -eq 0 ]; then
+            echo "no disaggregation documents to check"
+            exit 0
+          fi
+          python3 scripts/check_doc_citations.py "${documents[@]}" || true