docs/: fifteen paths name files and directories that are not in the tree

Fifteen paths in docs/ name files or directories that are not in the tree. Verified
against main at 0b8acf26 immediately before opening: every destination confirmed
present, every source confirmed absent, every commit read.

Opening as an issue rather than a pull request because CONTRIBUTING asks for one first, and
because only five of the fifteen have an answer I can give from outside.

Five are plain renames, and I can send them as a PR whenever you want

The first three moved together in 0da4f9a8 ("refactor: openapi, add readme", #448) and the
README that names them is itself in docs/server/ - the three files are its own
neighbours, and it points one directory up. The other two moved in 87fa2ac8 ("Implement
stateless core VMCP constructor", #5457). Git recorded all five as renames.

Five lines, three files, no prose changes. Sent as #6388, DCO-signed, so this half needs no decision from you beyond a review.

Eight need a judgement I should not make from outside

Grouped by what the deleting commit says it was doing, because the right fix differs.

Moved to toolhive-core, so the replacement is a cross-repository reference rather than a
path:

• docs/arch/03-transport-architecture.md:763 names pkg/permissions/profile.go, gone in
  80c3133f ("Move permissions and registry packages from toolhive to toolhive-core", #3912).
• docs/error-handling.md:62 names pkg/errors/errors.go as holding WithCode, Code and
  CodedError, gone in 2e5ac005 ("Adopt httperr from toolhive-core for HTTP error
  handling", #3551). The four neighbouring bullets in that list are all still correct.

Removed as dead code, so the line probably goes rather than moves:

• docs/arch/10-virtual-mcp-architecture.md:934 and docs/arch/vmcp-library.md:58 both name
  pkg/vmcp/discovery, removed in 6132d91b ("Remove dead vMCP discovery seam and default
  router", #5627).
• docs/arch/10-virtual-mcp-architecture.md:948 names
  pkg/vmcp/server/backend_enrichment.go, removed in 799b4222 ("Remove dead legacy
  session-registration path", #5622).

A feature that no longer exists:

• docs/arch/12-skills-system.md:553 has a table row "Lock file rollout gate |
  pkg/skills/feature_gate.go", removed in 78541159 ("Sign pushes by default and remove
  the lock feature gate", #6139). The other nine rows of that table are all still correct.

The registry section, which is half-updated and is the one worth a proper look:

• docs/arch/06-registry-system.md:922 names pkg/registry/schema_validation.go under
  Validation, gone in 80c3133f. Three lines above it the same paragraph already says
  the schemas are "published in stacklok/toolhive-core under registry/types/data/" - so
  the block knows about the move and the validation line did not follow. Worth noting:
  pkg/registry/schema_validation_test.go is still there and still runs as
  package registry, so the behaviour did not leave, only the filename.
• docs/arch/06-registry-system.md:863 names pkg/registry/types.go for "Provenance type
  definitions", gone in 8739ec42 ("Add registry format converters and support for the
  Official MCP Registry", #2469). The only type Provenance struct in the tree today is
  pkg/skills/lockfile/lockfile.go:98, which is the skills lockfile and looks like a
  different thing.

Two whole directories, not just files

• docs/arch/06-registry-system.md:864, the line directly under the Provenance one, names
  pkg/container/verifier/ for Sigstore and cosign verification. It went in 7095e8e1
  ("Remove /verifier in favour of one coming from toolhive-core", #3929) - so that paragraph
  is three implementation bullets and two of the three are gone, both to the same place.
• docs/arch/10-virtual-mcp-architecture.md:80 reads "Implementation: pkg/vmcp/
  (discovery: pkg/vmcp/discovery/, routing: pkg/vmcp/router/)". pkg/vmcp/router/ is
  there; pkg/vmcp/discovery/ went in 6132d91b with the dead seam above.

Worth saying plainly: docproof was silent on both of these until an hour ago. It skips a
documented directory when the parent is tracked, because git stores files rather than
directories and an empty one cannot be told from an absent one - and pkg/container is very
much alive. Finding pkg/container/verifier/ by hand while checking the rest is what showed
the guard was too broad. It is fixed and measured now, and it is mentioned here so you know
which of these came from the tool and which came from reading.

What found this

Found by docproof, a documentation checker that
resolves documented paths against the repository and its git history. It read 189 of this
project's 247 documentation files, 76%; the 58 it did not read are under .claude/,
deploy/, .github/, cmd/ and skills/, which are outside its default scope of
top-level files plus doc/ and docs/.