chore(migration): step 07d port api's link check to a root workflow

[surchs]

Title: chore(migration): step 07d port api's link check to a root workflow
Branch: migration/step-07d

Can be squash-merged or merged; it imports no history.

Summary

• New root workflow: .github/workflows/linkspector.yml, ported from api's upstream linkspector.yml (kept in migration/upstream-workflows/api/). The job is unchanged except for workdir: tools/api; the action changes into that folder before reading config_file: .linkspector.yml, so it checks api's README.md as upstream did.
  • It runs on PRs and pushes to main that touch tools/api/**/*.md, tools/api/.linkspector.yml or the workflow, and on workflow_dispatch. Upstream ran on every PR and push.
  • It keeps upstream's action defaults: findings are a check annotation on added lines and do not fail the job.
• migration/upstream-workflows/api/linkspector.yml: deleted. Only the two cff_validation.yml copies remain, for Step 19.
• migration/baseline.md: records the upstream link-check result (see below).
• Root README:
  • New "Repository-wide workflows" table (ci.yml, docs.yml, linkspector.yml).
  • A Step 7d row in the changes table, which lists the upstream automation workflows not carried over.
• No file inside tools/ changed.

Checks run

Check	Result
just lint (actionlint, shellcheck)	passes
linkspector 0.4.7 (the version action-linkspector@v1 installs) from tools/api with .linkspector.yml, in the puppeteer 24 image	55 working links, 1 failed: README.md:41 http://purl.bioontology.org/ontology/SNOMEDCT/248152002 Status:403
The same on upstream api's README (0375375)	identical: 55 working, 1 failed, same link. Recorded in migration/baseline.md as already failing upstream; upstream's workflow does not fail on it
scripts/check-unchanged.sh	OK
Link check runs on a PR touching tools/api/README.md, and not on a PR touching only tools/query-tool/	to be confirmed on GitHub

Deviations from the plan

• The Step 7d test "a PR touching tools/api/CITATION.cff runs the CFF validation" moved with cff_validation to Step 19 (maintainer decision, plan updated earlier).

Phase A exit check (run on this branch)

Check	Result
git log --oneline | wc -l ≥ sum of imported upstream commit counts	2715 ≥ 2669 (221 + 502 + 593 + 640 + 362 + 261 + 90)
git tag -l | sed 's/-v[0-9].*//' | sort | uniq -c	only annotation-tool 32, api 25, bagel-cli 38, federation-api 21, query-tool 36; no recipes
Every tool's suites match migration/baseline.md	yes: federation-api 111 (3.10–3.13), api 188 with graph / 182+6 deselected, bagel-cli 215 (3.11–3.14), query-tool component 89 and e2e 40, annotation-tool unit 240, component 180, e2e 20, docs strict build OK. Python suites re-run in every step; Cypress suites last run locally in Steps 5–6 and in CI on every frontend PR since.
A no-op PR runs only changes, check-unchanged (and lint)	needs a GitHub PR: push throwaway/noop-ci-check (prepared after this PR merges), open a PR, check the jobs, close it unmerged
Root README table has R1, R2, R3 rows linking to the README sections they changed	yes; all 14 links in the table resolve to existing files and headings
Every tool README has "Development in the Neurobagel monorepo"; none mentions git submodule update for recipes or neurobagel_examples	yes for all five tools and the docs; bagel-cli's only mention is for its three external submodules

Tags are still only local: run git push origin --tags before Step 11, as planned.

🤖 Generated with Claude Code