fix(validate): a dead link in an imported body warns instead of failing

[napetrov]

1 of 5 in a split stack.

#	PR	scope	base
1	#9	a dead link in an imported body warns instead of failing — unblocks Validate	main
2	#12	scope the Pages token to the deploy job and pin its actions — unblocks Security	main
3	#10	retry a 429 in the link check instead of accepting it	#9
4	#11	run the pinned-upstream check even when the link check failed	#9
5	#13	group the codeql-action pins so both halves move together	#9

#9 and #12 are independent and both go straight to main — they fix the two unrelated jobs
that are red there, and neither waits on the other. #10, #11 and #13 sit on #9 only so their
Validate runs are green while main's link check is failing; GitHub retargets them to main
when #9 lands.

main is failing two independent jobs, so any PR fixing one still displays the other.
Nothing here introduces the failure it shows:

PR	red check	fixed by
#9, #10, #11, #13	zizmor — the Pages workflow from #7	#12
#12	validate — the dead docs.vllm.ai link	#9

Everything else is green on every PR. All five test-merge into main cleanly in any order,
and the merged combination passes the full gate plus zizmor and actionlint.

What this changes

main is red on Validate, and every open pull request inherits it:

FAIL skills/vllm-xpu-run/SKILL.md: link
  https://docs.vllm.ai/en/latest/getting_started/xpu-installation.html is gone (HTTP 404)

The link really is dead — docs.vllm.ai dropped the .html URL scheme, so it now redirects
to a path that 404s. But skills/vllm-xpu-run/ is an import pinned to
intel/gpu-ai-skills, so editing the URL here would only move the failure one step down
the same job, to sync_external.py --check, which byte-compares the copy against its pin.
There is no edit to this repository that both satisfies the link check and keeps the
import intact.

Check 8 already resolves exactly this tension — a file a skill ships but never mentions
fails when the skill was written here and warns when it was imported, because "the only way
to satisfy it would be to edit another team's body, and an edited import no longer matches
the text their measurements describe". A dead link in an imported body is the same shape of
finding, so it gets the same treatment, and the warning says where the repair has to land:

WARN skills/vllm-xpu-run/SKILL.md: link ... is gone (HTTP 404)
  (imported: upstream's body is kept as it is — fix it upstream, then move external-commit)

link check: 99 URL(s), 1 gone, 1 of them only in imported bodies (warned)

What still fails, and this is the part worth reviewing:

finding	verdict	why
dead link in a body written here	error	ours to fix, and fixable here
dead link in an imported body	warn	upstream's text; editing it breaks the pin
external-commit gone from upstream history	error	shares the mechanism, not the ownership — the pin is our claim about upstream, not upstream's text

link_targets() now returns a third element naming which origin a URL came from, rather
than check_links() re-deriving it. The pinned-commit target is synthesised from
.source.json, so by the time it reaches check_links() it would otherwise be
indistinguishable from a URL found in the body it sits next to.

MAINTAINERS.md documents the route the warning asks for, and says the thing worth saying
out loud: a warning that outlives a release means the pin is the wrong pin.

Verified

Gate passes with the warning, and both error paths were exercised directly rather than
argued for — a dead link attributed to a body written here still errors, and a rewritten
external-commit still errors.

Follow-up, not in this PR

The stale docs.vllm.ai URLs themselves are fixed in intel/gpu-ai-skills#12. The pin
move here (bump external-commit on the three vllm skills, re-run sync_external.py --write) lands once that merges, and the warning goes away with it. Two of the three links
in that PR answer 200 while landing on the wrong page, via a Read-the-Docs fuzzy
redirect — no status-code link checker can see those, here or anywhere.

Checklist

• I checked description against requests a user would really type — see CONTRIBUTING.md. (no skill text changed)
• python3 tools/validate_skills.py passes locally.
• Every commit is signed off with git commit -s (DCO).