Remove legacy documentation dispatch after cutover

.github/SECURITY-HARDENING.md

@@ -62,7 +62,6 @@ Configure these GitHub Apps before the first release after this checklist lands:
 | Purpose                               | Repository access                                                            | Required permissions                  | Variables and secrets                                                  |
 | ------------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------- | ---------------------------------------------------------------------- |
 | Release artifacts and deploy dispatch | `veryfront`, `veryfront-server`, `veryfront-job-runner`, `veryfront-sandbox` | Contents: write                       | `VERYFRONT_RELEASE_APP_CLIENT_ID`, `VERYFRONT_RELEASE_APP_PRIVATE_KEY` |
-| Docs sync                             | `veryfront-docs`                                                             | Contents: write                       | `VERYFRONT_DOCS_APP_CLIENT_ID`, `VERYFRONT_DOCS_APP_PRIVATE_KEY`       |
 | Homebrew tap                          | `homebrew-tap`                                                               | Contents: write, Pull requests: write | `HOMEBREW_TAP_APP_CLIENT_ID`, `HOMEBREW_TAP_APP_PRIVATE_KEY`           |
 
 The release App private key must only be used on fresh public-upload and downstream-dispatch runners. These runners must never check out repository code, invoke local actions, run package code, or execute downloaded assets. npm publishers and SBOM preparation pass inert assets through a SHA-addressed artifact and never receive the release App identity or key. Limiting the repositories on one installation token does not limit what its private key can mint.

src/security/repository-hardening.test.ts

@@ -144,7 +144,6 @@ describe("repository hardening", () => {
         "External fork pull requests",
         "GitHub App release credentials",
         "VERYFRONT_RELEASE_APP_CLIENT_ID",
-        "VERYFRONT_DOCS_APP_CLIENT_ID",
         "HOMEBREW_TAP_APP_CLIENT_ID",
         "GH_PAT_VERYFRONT",
         "GH_PAT_HOMEBREW_TAP",
@@ -270,38 +269,32 @@ describe("repository hardening", () => {
   });
 
   it("uses scoped GitHub App tokens instead of release PATs", async () => {
-    const releaseWorkflow = await readText(".github/workflows/cicd.yml");
-    const docsWorkflow = await readText(".github/workflows/sync-docs.yml");
-    const workflows = `${releaseWorkflow}\n${docsWorkflow}`;
+    const workflow = await readText(".github/workflows/cicd.yml");
 
-    assertEquals(workflows.includes("GH_PAT_"), false);
-    assertEquals(workflows.includes("HOMEBREW_TAP_PAT"), false);
+    assertEquals(workflow.includes("GH_PAT_"), false);
+    assertEquals(workflow.includes("HOMEBREW_TAP_PAT"), false);
 
     for (
       const required of [
         CREATE_APP_TOKEN_ACTION,
         "client-id: ${{ vars.VERYFRONT_RELEASE_APP_CLIENT_ID }}",
         "private-key: ${{ secrets.VERYFRONT_RELEASE_APP_PRIVATE_KEY }}",
-        "client-id: ${{ vars.VERYFRONT_DOCS_APP_CLIENT_ID }}",
-        "private-key: ${{ secrets.VERYFRONT_DOCS_APP_PRIVATE_KEY }}",
         "client-id: ${{ vars.HOMEBREW_TAP_APP_CLIENT_ID }}",
         "private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}",
         "repositories: |",
         "veryfront-server",
         "veryfront-job-runner",
         "veryfront-sandbox",
-        "veryfront-docs",
         "homebrew-tap",
         "permission-contents: write",
         "permission-pull-requests: write",
         "steps.release-app-token.outputs.token",
-        "steps.docs-app-token.outputs.token",
         "steps.homebrew-app-token.outputs.token",
       ]
     ) {
       assert(
-        workflows.includes(required),
-        `expected workflows to use ${required}`,
+        workflow.includes(required),
+        `expected workflow to use ${required}`,
       );
     }
   });