link-validation.ts misses several anchors and never fails CI

Problem

scripts/link-validation.ts runs on every PR (via lint.yml → pnpm run check) but doesn't actually catch broken links, for two reasons:

• It only recognizes anchors from real Markdown headings and literal <a id="..."> tags. Most anchors on API reference pages come from <APIItem id="...">, which it doesn't parse, so it can't tell if those are broken or fine.
• It never sets a non-zero exit code, so even when it does find a broken link, the CI step still reports success. Confirmed live: the "Lint and Format Check" run on PR #233 merged commit passed despite 85 broken anchors in that commit.
  On top of that, main has no branch protection (protected: false, no required status checks), so even a correctly-failing check wouldn't block a merge today.

Proposed fix, staged (not a single flip to hard-fail):

• Extend anchor detection to recognize <APIItem id="..."> (and similar components). Keep it non-blocking for now.
• Let that surface the real, sitewide baseline of broken links (there are known pre-existing ones outside Cairo 4.x too), and clean those up or snapshot them.
• Only then add the non-zero exit code.
• Add branch protection on main requiring the lint job, once step 3 is trustworthy.
• Doing 3–4 before 1–2 would fail unrelated PRs on pre-existing debt they didn't introduce; hence the order.