Re-sync check-docs.php with the family, and let it run where git does not

Takes woo-security-manager's current checker (sibling-hook boundary via FAMILY_PREFIXES, table-row scoping), keeping the floor in ci/plugin.conf. dist-files.sh now lists the same files in a git-less copy, which is what ci_php's php container is handed on the Gitea runner; before, check-docs failed there with exit 127.

Co-Authored-By: Claude Code <noreply@anthropic.com>

ci/dist-files.sh

@@ -25,7 +25,18 @@ done < .distignore
 # with nothing said. (-z also covers paths with spaces.) Found in a sibling
 # plugin that has exactly such a filename; this repo has none today, which is
 # precisely why it would have sat here until someone added one.
-git ls-files -z | while IFS= read -r -d '' file; do
+# In a git-less copy (ci_php's php container, which is handed exactly the
+# tracked files and has no git) the tree IS the tracked set, so walk it.
+# selftest.sh asserts the two forms print the same list.
+tracked() {
+  if [ -e .git ]; then
+    git ls-files -z
+  else
+    find . -type f -print0 | sed -z 's|^\./||' | LC_ALL=C sort -z
+  fi
+}
+
+tracked | while IFS= read -r -d '' file; do
   keep=1
   for p in "${patterns[@]}"; do
     # A bare name excludes the file or directory wherever it appears, which is