Harden local docs sync against dirty sibling checkouts

Migrated from: https://github.com/jeremi/registry-docs/issues/71
Original author: @jeremi
Source repository: `jeremi/registry-docs`
Source issue: `#71`
Source labels: enhancement, post-1.0
Source milestone/release intent: _none_
Target area/path: `docs/site`

## Issue

Audit candidate: CAND-ARTIFACTS-01, downgraded to local tooling hygiene.

Background:
GitHub Pages builds use clean runners and pinned refs, so this is not currently a public docs publication risk. Local developer builds can still prefer an existing sibling checkout without checking cleanliness or HEAD, which can confuse local review or generated archives.

Acceptance criteria:
- Local docs sync warns, rejects, or ignores sibling checkouts that are dirty or not at the pinned ref.
- GitHub CI behavior remains pinned-clean and does not depend on local sibling paths.
- Tests or script checks cover dirty and wrong-ref sibling checkout cases.

Non-goals:
- Changing public GitHub Pages deployment if it already builds from clean pinned refs.

## Migration Metadata

- Migrated to the public monorepo on 2026-06-25.
- Source title, body, labels, milestone/release intent, and pre-migration discussion were preserved where available.
- Code-grounded audit note: Docs sync still prefers sibling checkouts and lacks dirty/wrong-ref gates.
- Private/internal references, secrets, and obvious deployment-only details were redacted instead of copied forward.

Begin in docs/site and locate the local docs sync entry point; inspect how sibling checkouts are selected and how pinned refs are represented. Add checks or warnings for dirty and wrong-ref siblings while preserving clean pinned CI behavior, then cover both cases with tests or script checks.

Written by the indexing model from the issue text.