orchestration: refresh for the public-docs-drift flow (14→15)

The Kestra namespace gained public-docs-drift since this doc was last
verified. New flow-list screenshot (Total: 15), flow-patterns diagram
re-exported to 14 of 15 no-gate, and the pause-step snippet now includes
it. Also corrects the "only two things write to Trilium" claim — that
flow stamps #pendingPublicDoc labels, making it a third writer (labels
only, never content). Same correction applied to the KB source note.

docs/orchestration.md

@@ -1,12 +1,12 @@
-<!-- verified: 2026-09-06
-     ansible@ccbda37 : host_vars/hyper2.yml, roles/os_update/tasks/reboot.yml, playbooks/os_update_pve_verify.yml, playbooks/automation_self_update.yml
+<!-- verified: 2026-09-07
+     ansible@9a4ba6d : host_vars/hyper2.yml, roles/os_update/tasks/reboot.yml, playbooks/os_update_pve_verify.yml, playbooks/automation_self_update.yml
      trilium : bW84ccRoAJ5i, tt4idCVJPpZM
 -->
 
 # 🔁 Orchestration
 
 > [!NOTE]
-> Kestra runs every scheduled maintenance flow across the fleet — 14 flows covering OS updates, container updates, app updates, disk cleanup, fleet inventory, and KB self-maintenance. Most run straight through on their own schedule with nobody watching; exactly one is built around a check → pause → human approval → apply pattern instead, reserved specifically for the one category of change judged worth a checkpoint.
+> Kestra runs every scheduled maintenance flow across the fleet — 15 flows covering OS updates, container updates, app updates, disk cleanup, fleet inventory, KB self-maintenance, and public-doc drift checks. Most run straight through on their own schedule with nobody watching; exactly one is built around a check → pause → human approval → apply pattern instead, reserved specifically for the one category of change judged worth a checkpoint.
 
 This is the real flow list, not a claimed count:
 
@@ -18,7 +18,7 @@ A blanket human-gate policy was the obvious simpler design, and it was rejected:
 
 ## Two Patterns, Not One
 
-![13 of 14 flows run straight through on schedule with no human gate, relying on the automated health-check/rollback path instead; the one flow applying Vault/Technitium/Alloy updates runs a check-mode pass, pauses indefinitely on anything pending, and only applies after explicit human approval](../assets/orchestration-flow-patterns.svg)
+![14 of 15 flows run straight through on schedule with no human gate, relying on the automated health-check/rollback path instead; the one flow applying Vault/Technitium/Alloy updates runs a check-mode pass, pauses indefinitely on anything pending, and only applies after explicit human approval](../assets/orchestration-flow-patterns.svg)
 
 That's not just a diagram of the pattern — it's the actual flow's own topology in Kestra, `wait_for_approval` sitting right there as a real node between the pending-check and the apply step:
 
@@ -30,7 +30,8 @@ This is the real check, not an assumption — every flow's own definition, queri
 
 ```
 $ for flow in os-update-vms os-update-pve os-update-pve-verify os-update-pbs \
-              container-update disk-cleanup app-update homelab-inventory-sync; do
+              container-update disk-cleanup app-update homelab-inventory-sync \
+              public-docs-drift; do
     echo "$flow: $(curl -s .../flows/homelab/$flow | grep -c 'core.flow.Pause')"
   done
 os-update-vms: 0
@@ -41,6 +42,7 @@ container-update: 0
 disk-cleanup: 0
 app-update: 1
 homelab-inventory-sync: 0
+public-docs-drift: 0
 ```
 
 ## One Dedicated Identity, Not a Shared One
@@ -79,7 +81,7 @@ This is the actual KV Store, not a description of it — exactly two entries, no
 
 ## Trilium KB Self-maintenance
 
-Two flows keep this fleet's own internal knowledge base structure current — the *only* two things allowed to write to it, everything else (including this repo's own generation) only ever reads from it:
+Two flows keep this fleet's own internal knowledge base structure current. Those two, plus one more that only ever tags notes for review without altering their content, are the only things that write to the KB at all — everything else, including this repo's own generation, strictly reads from it:
 
 | Flow | Trigger | What it does |
 |---|---|---|