ci(docs): lock mint CLI via docs manifest

.github/dependabot.yml

@@ -37,3 +37,16 @@ updates:
       github-actions:
         patterns:
           - "*"
+
+  - package-ecosystem: "npm"
+    # Docs CI tooling (mint) locked in docs/package-lock.json; see the
+    # `docs-validate` job in .github/workflows/test.yml.
+    directory: "/docs"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"
+    groups:
+      npm:
+        patterns:
+          - "*"

.github/workflows/test.yml

@@ -325,11 +325,17 @@ jobs:
         uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version: '22'
+          cache: npm
+          cache-dependency-path: docs/package-lock.json
 
       - name: Validate docs.json
         if: steps.changes.outputs.docs == 'true'
-        run: npx mint validate
         working-directory: docs
+        env:
+          # mint validate is static; puppeteer's chrome download (only needed
+          # by mint dev / broken-links) is a slow, flaky third-party fetch.
+          PUPPETEER_SKIP_DOWNLOAD: '1'
+        run: npm ci --no-fund --no-audit && npm run validate
 
   # Compiling the binary doesn't depend on tests passing, so this runs in
   # parallel with the test jobs rather than gating behind them. It is the one

.gitignore

@@ -43,5 +43,9 @@
 /web/dashboard/node_modules/
 /internal/admin/dashboard/static/dist/
 
+# Mintlify CLI pinned for docs validation; see docs/package.json and the
+# `docs-validate` job in .github/workflows/test.yml.
+/docs/node_modules/
+
 # Example plugin shared objects built by `make example-plugins`.
 /plugins/