Re-sync check-docs.php with the family, and let it run where git does not

Takes woo-security-manager's current checker (sibling-hook boundary via FAMILY_PREFIXES, table-row scoping), keeping the floor in ci/plugin.conf. dist-files.sh now lists the same files in a git-less copy, which is what ci_php's php container is handed on the Gitea runner; before, check-docs failed there with exit 127.

Co-Authored-By: Claude Code <noreply@anthropic.com>

ci/selftest.sh

@@ -400,6 +400,19 @@ else
 fi
 cp "$work/helpers.orig" includes/class-helpers.php
 
+# 1b. the same fault for a hook a SIBLING owns and we answer. Before
+# FAMILY_PREFIXES this fell into "core, not ours to document" and stayed green.
+printf '\n// Added by ci/selftest.sh.\nadd_filter( %s, %s );\n' \
+  "'nlsec_selftest_sibling'" "'__return_true'" >> includes/class-helpers.php
+if [ "$(grep -c 'nlsec_selftest_sibling' includes/class-helpers.php)" -lt 1 ]; then
+  bad "could not stage the sibling-hook fixture"
+else
+  printf '%s' "$(docs_verdict)" | grep -q 'not in docs/CONTRACT.md: .*nlsec_selftest_sibling' \
+    && ok "flagged a sibling-owned hook we answer and CONTRACT.md does not mention" \
+    || bad "NOT FLAGGED: an undocumented sibling hook — the whole boundary to another plugin is invisible"
+fi
+cp "$work/helpers.orig" includes/class-helpers.php
+
 # 2. 🔴 the control that matters: the same name, in a COMMENT only. The checker
 # must stay GREEN, and this asserts the specific success line rather than an
 # exit code — a refusal, a missing file or a fatal all exit non-zero too, and
@@ -451,11 +464,29 @@ else
 fi
 git checkout -q -- docs/README.md 2>/dev/null || cp "$work/README.md.orig" docs/README.md
 
+# 5b. the file list must be the same without git. ci_php runs check-docs.php in
+# a php container that is handed the tracked files and has no git; dist-files.sh
+# used to exit 127 there, so the docs check failed on the Gitea runner alone.
+nogit=$(mktemp -d)
+git ls-files -z | tar --null -T - -cf - | tar -xf - -C "$nogit"
+if [ -e "$nogit/.git" ]; then
+  bad "could not stage the git-less copy"
+else
+  with_git=$(./ci/dist-files.sh)
+  without_git=$(cd "$nogit" && ./ci/dist-files.sh 2>&1 || echo "exit $?")
+  if [ -n "$with_git" ] && [ "$with_git" = "$without_git" ]; then
+    ok "dist-files.sh lists the same $(printf '%s\n' "$with_git" | wc -l | tr -d ' ') files with and without git"
+  else
+    bad "dist-files.sh differs without git — the docs check goes red on the Gitea runner only"
+  fi
+fi
+rm -rf "$nogit"
+
 # 6. both conf values must refuse rather than default. An unset floor parses to
 # 0 and every comparison against it passes, and a guessed prefix classifies
 # every hook in the tree as somebody else's.
 cp ci/plugin.conf "$work/conf.orig"
-for key in HOOK_PREFIX MIN_SHIPPED_PHP_FILES; do
+for key in HOOK_PREFIX MIN_SHIPPED_PHP_FILES FAMILY_PREFIXES; do
   grep -v "^$key=" "$work/conf.orig" > ci/plugin.conf
   if [ "$(grep -c "^$key=" ci/plugin.conf)" -ne 0 ]; then
     bad "could not stage the missing-$key fixture"