docs: replace the claims the source does not support

An audit checked 204 documented claims against the code. Roughly a third of the docs tree described something that does not exist. This corrects every claim that would break a reader following it, and rewrites the two pages that were fabricated outright.

[!NOTE] Stacked on #1399 — review that first. The base will retarget to main once it merges.

Commands and flags that were never registered

buddy init, buddy help and buddy workflow <name> do not exist. install.md told a new user to run buddy init as the final verification step of installation.

Around fifteen documented flags do not exist either — buddy update --assignee/--reviewers/--labels/--auto-merge, buddy scan --dry-run, buddy schedule --cron, buddy open-settings --type and more. clapp hard-errors on an unknown option, so these examples crashed rather than degraded. usage.md shipped three copy-pasteable shell scripts built entirely from flags that do not exist.

Where a flag was invented for something Buddy genuinely does, the example now shows the configuration that actually does it.

Packages and downloads

• The dependency parser is ts-pantry, not ts-pkgx — which appeared in eight files, including a bunx ts-pkgx resolve invocation that cannot work. grep -rn ts-pkgx src bin returns zero.
• The npm package is @buddysh/buddy. The bun and yarn tabs installed a bare buddy belonging to someone else; the npm and pnpm tabs were already correct, which looks like a partial find-and-replace.
• Binary downloads pointed at unzipped assets pinned to a v0.9.1 tag. Releases only ever contain buddy-<platform>.zip, so every documented curl URL 404s. Now fetches from /releases/latest/download/ and unzips.

Workflows and gates

• Setup writes buddy.yml and buddy-security.yml — not the three files the docs listed. It actively deletes those three names as stale (src/setup.ts:2028).
• Rebase detection is event-driven on pull_request: [edited], not an every-minute cron.
• The published check run is buddy/gates, plural. Branch protection requiring buddy/gate matches nothing, so the gate silently blocked nothing.

Two pages rewritten

labeling-assignment.md and api/configuration.md were fabricated outright — a static/dynamic label DSL and some forty non-existent interfaces respectively. Both rewritten against the real types.

Footguns now stated plainly

• packages.ignore is exact string equality, not globs — @types/* there silently ignores nothing. The adjacent ignorePaths does take globs.
• A catch-all matcher is matchPackages: ['**']. Package names match as paths, so ['*'] stops at the slash in a scoped name and misses every @scope/… package. Verified against Bun.Glob.
• security-only auto-merge reads a label Buddy never applies on its own.

Verification

• 1885 pass / 0 fail, lint clean, typecheck clean
• Docs site builds: 73 pages
• All twelve audit patterns now grep clean across README.md, CLAUDE.md, docs/, src/, bin/ and .github/workflows/

Part 2 of 3.

🤖 Generated with Claude Code

https://claude.ai/code/session_01UWouahBJT3msK7V2VDYY6T