Translations are hand-maintained with no provenance: 86% of a docs PR is churn, and 16 of 256 are already stale #66

Problem

AGENTS.md rule #1 already says English is the single source of truth and every locale is derived. Nothing enforced it and nothing measured it, and both halves of that gap are now measurable:

Cost. The last two content PRs spent 86% of their diff on hand-maintained locale siblings — #63 changed 63 files, 54 of them translations; #62 changed 28, 24 of them translations. Every English edit obligates its author to also produce six translations, so the marginal cost of a one-line English fix is six file edits in languages the author may not read.

Undetectable drift. 256 translations are checked in with no record of which English revision they were derived from. Walking git history (for each translation, did its English sibling change after the translation's last commit?) finds 16 already stale, across three English pages:

• content/docs/configure/authentication.* — 5 locales
• content/docs/index.* — 5 locales
• content/docs/resources/faq.* — 6 locales

Nothing reports this today, and nothing can: with no recorded provenance, a translation that no longer matches its source is indistinguishable from one that does.

This matters more than a missing translation. Fumadocs falls back to English when a locale sibling is absent, so a missing translation renders correct English. A stale one renders content the English source no longer claims — on a customer-facing site, on pages including resources/license and reference/security.

Coverage for reference (English pages without a sibling): zh-Hans 17, ja 40, de 41, es 40, fr 40, ko 40.

Required outcome

Translations become a generated artifact with machine-checkable provenance, and the split "humans write English, the translation pass writes translations" becomes a CI rule rather than a convention:

1. Every translation records the sha256 of the English sibling it was derived from, so staleness is detectable.
2. A gate that blocks on unaccounted-for translations (no provenance, or English source deleted) but not on staleness — an English edit landing alone is the design, not an oversight. Forcing the English author to also produce six translations is the cost this removes.
3. A worklist a periodic translation pass can consume, so "translate the stale ones" is a bounded task rather than a full retranslation.
4. Ownership enforced by PR author, so neither half of the split can erode.
5. A written contract for the translation pass: what is never translated, the glossary, and the pre-PR checks.

Constraints: no locale is dropped (all six stay); the checks must run with no dependencies, no network and no credentials, so they work on fork PRs and add no secret to this public repository.

Process note

This issue is filed after the work — PR #65 already implements it. That is a deviation from claim-before-work and it is recorded here rather than papered over. The PR is linked below and the claim comment follows.