fix(docs): catch a stale site banner and missing What's New entry; publish v3.3.0 on the site

[nugehs]

Summary

• The site was behind: bashbop.github.io/otito still said v3.2.0, and What's New had no 3.3.0 entry, even though v3.3.0 has been published to npm and GitHub Releases since 2026-09-27. The docs deploy itself was fine: the last deploy (7dd8187) published fec3bd0, the 3.3.0 merge. The content was stale.
• Root cause: docs/index.md now opens with a **vX.Y.Z** is published banner, which replaced the **Status:** v line. src/lib/version-docs.js only knew the old line, so sync-server-version.mjs never rewrote the banner and version:check never flagged it. The release went out green. What's New is written by hand, and nothing checked it.
• Fix:
  • syncPinnedDocVersion rewrites the published banner, and findPinnedDocVersionDrift reports it.
  • A new findWhatsNewDrift fails version:check when What's New has no vX.Y.Z published entry for the package.json version. A different version that shares a prefix (3.3.01, 3.3.0-rc.1) doesn't count, and docs without the section (RELEASE.md) are skipped.
  • The site gets its v3.3.0 banner and a What's New entry summarised from the 3.3.0 changelog.
  • Merging deploys the site through deploy-docs.yml, since docs/** changed. package.json is still 3.3.0, so Tag release tags nothing.

Change Type

• Bug fix
• Feature
• Documentation
• Tests or CI
• Refactor

Validation

• format:check, lint, typecheck, version:check, docs:diagram:check, test (800/800), test:coverage (94.66 / 81.20 / 96.00; thresholds met): all pass
• mkdocs build --strict: pass; the built index.html shows v3.3.0 and v3.3.0 published (2026-09-27)
• Before the fix, version:check on the new code against the old docs/index.md failed with published banner says v3.2.0 but package.json version is 3.3.0
• skills:check fails, as it does on main. It compares the locally installed .cursor/ and .codex/ copies of otito-scope/SKILL.md (not tracked in this repo) against codex/skills. That's machine state, untouched here.

Version Impact

• None: docs, tests, CI, or internal-only change
• Patch: bug fix or low-risk internal improvement (entry under [Unreleased]; no version bump in this PR)
• Minor
• Major

Review Notes

• I kept generated artifacts under .otito/ out of the commit.
• I updated README, skill docs, or eval metadata for command, package script, MCP tool, schema, or output changes. (n/a: no command or output change)
• I identified any skipped checks or follow-up work below.

Follow-up: #240 (context/impact fixes) merged after v3.3.0 with no [Unreleased] changelog entry, so the next release notes need one for it.