M1 — Fix Scout contradictions

Sub-issue of #37124. Scout half of the Rock — mirrors Jose's M1 (#37126). Depends on M0.

Description

Fix the contradictions found in M0 across docs/testing/, the docs/core/ slice, .cursor/rules/ and .claude/commands/. Each fix verified against real source, the same standard M1–M3 held on the backend side: if a doc names a class, method, Maven property or command, it must exist in the codebase.

Acceptance Criteria

• Every contradiction from M0's inventory either fixed or explicitly deferred with a reason
• Each fix verified against real source — no doc left citing a class, annotation, property or command that doesn't exist
• .cursor/rules/ and .claude/commands/ cross-checked against CLAUDE.md's Critical Rules — both directories fully audited: .claude/commands/ in #37610, .cursor/rules/ in #37590 and #37629
• Three known broken links repaired — #37627:
  • .specify/memory/constitution.md → docs/core/ROLLBACK_UNSAFE_CATEGORIES.md — now ../../docs/core/
  • .specify/memory/constitution.md → docs/core/SECURITY_PRINCIPLES.md — now ../../docs/core/
  • core-web/CLAUDE.md → docs/frontend/STYLING_STANDARDS.md — now ../docs/frontend/, matching line 142 of the same file; #form-fields anchor confirmed at STYLING_STANDARDS.md:149

Two contradictions already confirmed (found while scoping this issue)

• The Java-version mismatch survives in .cursor/rules/java-context.mdc. It still states Core: Java 11 syntax. CLI: Java 21 ok. Runtime: Java 21. Root CLAUDE.md:68 no longer pins a version at all — it defers to .sdkmanrc for the runtime and dotcms.core.compiler.release in parent/pom.xml for core modules. M1 (#37126) fixed this in the docs; the Cursor rule was outside Falcon's slice and was left behind, so the exact failure mode this Rock exists to stop is still being fed to anyone working from Cursor.
• The integration-test registration rule never reached .cursor/rules/. MainSuite/Junit5Suite appears nowhere under .cursor/rules/. test-context.mdc tells the reader to run ./mvnw -pl :dotcms-integration verify -Dcoreit.test.skip=false with no mention that an unregistered test compiles, passes, and is silently never run in CI — the rule #37127 added to CLAUDE.md's Critical Rules. Related gate: #37581.

Both fixed in #37590 (merged 496ccc7463, Sep 17). java-context.mdc now points at .sdkmanrc and dotcms.core.compiler.release instead of naming a version, with a line against hardcoding one again. test-context.mdc states the consequence — unregistered means compiles, passes review, silently never runs in CI — and defers the choice of suite to docs/testing/INTEGRATION_TESTS.md, per review feedback from @nollymar and @jcastro-dotcms: #37583 had just established that the suite set isn't fixed and the pick depends on current CI timings.

.claude/commands/ was audited in the same pass and fixed in #37610: /gh-issue-troubleshoot step 6c was telling the model to register new integration tests in the suite with the fewest @SuiteClasses entries — an invented rule. That directory is now done; .cursor/rules/ is not: java-context.mdc and test-context.mdc were read in full, but README.md, doc-updates.mdc, dotcms-guide.mdc, e2e-rules.mdc and frontend-context.mdc have not been, so the cross-check criterion above stays open.

• Monitoring gate opened for each merged change (see Definition of Done in #37124)

Priority

High

Remaining, as of Sep 18

Merged so far: #37590 (both Cursor-rule contradictions), #37610 (.claude/commands/), #37627 (the three broken links).

Still open on this issue:

• .cursor/rules/ is 2 of 7 files. Done — #37629 (merged Sep 18) covered the remaining five. Findings: dotcms-guide.mdc, the only alwaysApply: true rule, had Critical Reminders missing both the integration-test registration rule and any Java-version pointer; doc-updates.mdc's glob was **/*.mdc while its own description claims .md/.mdc; README.md indexed five of six rules and misdocumented that glob; frontend-context.mdc named two apps (content-drive-ui, edit-ema-ui) that don't exist.
• The two M0-dependent criteria can't be ticked until #37576 produces its inventory. This issue exists to fix what that one finds.
• The monitoring gate opened with #37590 on Sep 17 and runs into early October. Tracked in #37581, baseline 0 of 28.

Out-of-scope finding from the link work: a sweep of all 539 tracked .md files found 77 more broken relative links — 65 in specs/, 9 in .github/ (8 of them written with a leading slash, which doesn't resolve on github.com), 3 elsewhere. None in docs/. Flagged for the backlog in #37580 rather than fixed here.