Harden docs build after Zensical migration

[blsmth]

Follow-ups from #26, in the order they need to land.

1. build/run now depend on the CLI reference pages

src/command-line-reference/ is gitignored, so a fresh clone has none. Before this, make build there exited 0 and rendered all 84 CLI nav entries as raw, unrewritten .md hrefs against pages that were never generated:

href="./command-line-reference/apppack.md"

Zensical validates page body links but not nav entries, so those 84 dead links produced zero warnings. make build and make run now generate the pages when the directory is missing. An existing directory is left alone, so CI — which already calls make cli-docs — doesn't run docgen twice. make cli-docs still forces a refresh.

2. --strict on zensical build

Broken links and bad anchors warned but exited 0, so they could deploy. Depends on #1: without it, --strict would fail a fresh-clone build on the missing CLI pages.

Worth correcting a claim in #26 — Zensical does not ignore validation. config.py:616-651 maps validation.links.not_found to invalid_links and .anchors to invalid_link_anchors, both defaulting to True. Link checking is actually broader than before, since anchors weren't validated under the old config. Only the absolute_links rewrite is unsupported, which is why the six link conversions in #26 were needed.

3. Nav completeness check

scripts/check_nav_complete.py, wired into CI after the CLI docs step. A page missing from the explicit nav: still builds, gets a URL, and lands in sitemap.xml and the search index — but nothing links to it, and the build says No issues found. Zensical has no validation.nav.omitted_files; its config module says navigation validation is deliberately out of scope for now. The literate-nav directory globs that used to pick up new pages automatically are gone.

The check catches both directions: pages on disk missing from the nav, and nav entries with no page on disk.

4. Smaller items

• generate_cli_nav.py runs under uv run python instead of python3. Everything else in the Makefile uses uv run, while python3 picked up system Python (3.9.6 locally) against requires-python = ">=3.14".
• encoding="utf-8" on that script's read/write.
• Comment in mkdocs.yml noting Zensical silently ignores unknown plugins — that's how literate-nav failed quietly during the migration, and it's the failure mode to expect on future upgrades.
• __pycache__/ added to .gitignore; the macros plugin imports main.py and leaves a .pyc behind, which was showing up as untracked.

Verified

• make cli-docs && make check-nav && make build — clean, No issues found, 112 pages
• Removed src/command-line-reference/ and ran make build: regenerates, 84 pages built, 0 dead .md nav hrefs (84 before)
• With the directory present, make build does not re-run docgen
• Temporary orphan page: make check-nav exits non-zero and names the file; passes again once removed
• Temporary broken link, then a bad anchor: make build exits non-zero on both
• mkdocs.yml diff is comment-only after make cli-docs, so the generated nav block is byte-identical and still idempotent