Check the docs' claims against the code mechanically

Translating everything into Chinese found four claims that had already drifted, and
none of them were caught by reading -- they were caught by comparing against source.
Proofreading does not find rot, so do the comparison mechanically and keep doing it.

tools/check_docs.py verifies that every tool a README names exists, that every test in
run_tests.sh is documented in both languages, that internal .md links resolve, that the
translation pairs have matching heading structure, that memory-map addresses match the
model's #defines, and that documented firmware file:line references still point at what
the prose claims. It runs in the quick tier of run_tests.sh, needing no emulator.

Confirmed it can actually fail, because a checker that cannot is worthless: renaming a
documented tool and deleting a heading from the Chinese side each produce one named
failure and exit 1, and reverting returns it to clean.

One thing it deliberately does not check. An early version compared firmware constants
with a regex that took the first number on a line, so `key_debounce_10ms = 20 / 10` read
as 20 and it declared the docs wrong for saying 2. The docs were right and the checker
was broken. A checker that cries wolf gets ignored, so claims it cannot verify
unambiguously are left out rather than guessed at.

Current state: 16 file:line references all accurate, 7 memory-map addresses all match,
zero broken links, all three translation pairs structurally aligned.

AGENTS.zh-CN.md

@@ -412,6 +412,25 @@ GCC 能看到全部调用者。如果一个模型的输出神秘地不起作用
 模拟器测试会在私有端口上启动自己的 QEMU，每个耗时 20-30 秒，所以它们不会干扰
 正在运行的 `run.sh` 或网页界面会话。
 
+### 让文档保持诚实
+
+    python3 tools/check_docs.py     # 也作为 run_tests.sh -q 的一部分运行
+
+**文档会静默腐化，而通读是发现不了的。** 把全部文档翻译成中文的过程中，
+翻出了四处**已经漂移**的断言：接口表缺三个路由、已建模外设列表漏了 TIM2、
+审计表在 TIM2 已建模之后仍把 TIM 称作 stub、两个 README 都没列出几个库模块。
+**这四处全是靠与源码比对发现的，没有一处是校对读出来的。**
+
+所以现在这个比对是机械化的。它检查：每个 README 提到的工具是否存在、
+`run_tests.sh` 里的每个测试在两种语言里是否都有记录、内部 `.md` 链接是否都能解析、
+翻译对的标题结构是否匹配、内存映射地址是否与模型的 `#define` 一致、
+以及文档里的固件 `file:line` 引用是否仍指向正文声称的东西。
+
+写它的过程中有一个教训。早期版本用一个"取行内第一个数字"的正则来比对固件常量，
+于是 `key_debounce_10ms = 20 / 10` 被读成 20，检查器于是宣布文档说 2 是错的。
+**文档是对的，检查器是坏的。** 一个总在虚报的检查器会被忽略，
+所以凡是它无法无歧义验证的东西，都宁可不查，而不是靠猜。
+
 ### 数"有多少帧不同"证明的东西比看起来少
 
 写任何观察屏幕的测试之前值得知道这一点。