feat(gates): own both content roots' frontmatter, each with its own floor (#10754) (#11898)

`apps/docs/source.config.ts` calls `defineDocs` twice. `check-doc-frontmatter`
walked only the first, so `content/blog` frontmatter was owned by nothing below
`Build Docs` -- an unquoted `description` holding a colon there is the identical
defect, reaching the identical 30-minute `next build`.

`ROOTS` is now a declared list and each entry carries its OWN floor. That is the
whole difficulty, and it is one line of arithmetic: a union count of 403 + 3 is
satisfied by 403 + 0, so a union gate would let an emptied `content/blog` hide
behind the docs root and report coverage the run does not have. The floor lives
inside `judgeRoot`, which is handed one root and can see no other, and `judgeAll`
collects refusals instead of summing pages.

Each root also declares its own key contract, since `blogSchema` is
`pageSchema.extend({ author, date, tags })`: `author` and `tags` are asserted,
and `date` is pinned as deliberately unasserted because `z.coerce.string()`
accepts every value YAML can produce. The self-test pins `ROOTS` and that key
list against `source.config.ts` itself, so a third `defineDocs` call cannot
arrive unowned the way the second one did.

No workflow edit: the existing lint.yml step already invokes this script.
`content/blog` is untouched -- all three pages were already clean.


Claude-Session: https://claude.ai/code/session_015ahemw8RcTgqtxrj15PEZx

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]