ci(docs): run the framework setup-concept gate in CI (refs OSS-1036)

The coverage ratchet added for OSS-1036 never ran in CI. No workflow runs the
shell-docs vitest suite: `test_integration-docs.yml` runs exactly one test
file, `test_unit-showcase.yml` covers harness and shell-dashboard only, and
`showcase_build_check.yml` matches `showcase/**` but only builds images. On top
of that, neither path filter listed the snippet files the gate reads, so a new
`frontend-tools-setup.mdx` triggered nothing.

Add a scoped job and widen both filters. The job is deliberately limited to the
two setup-concept test files, because the full shell-docs suite is not green on
main and would gate every snippet change on unrelated failures.

The harness symlink step is the same one showcase/shell-docs/Dockerfile uses:
`generate-registry.ts` imports the catalog fold out of the harness tree, which
resolves `js-yaml` by walking up from `showcase/harness/`.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/test_integration-docs.yml

@@ -6,6 +6,17 @@ on:
       - "showcase/shell-docs/src/content/**"
       - "showcase/shell-docs/model-allowlist.json"
       - "showcase/shell-docs/src/lib/__tests__/ms-agent-dotnet-provider.test.ts"
+      # The setup-concept gate below reads snippets owned by the integration
+      # packages and by the docs-only snippet tree, so a new or edited snippet
+      # has to trigger this workflow. Before OSS-1036 neither path was listed,
+      # and the coverage ratchet never ran in CI at all.
+      - "showcase/integrations/*/docs/setup/**"
+      - "showcase/integrations/*/manifest.yaml"
+      - "showcase/shell-docs/src/lib/setup-content.ts"
+      - "showcase/shell-docs/src/lib/setup-concept.tsx"
+      - "showcase/shell-docs/src/lib/__tests__/frontend-tools-setup-coverage.test.ts"
+      - "showcase/shell-docs/src/lib/__tests__/setup-concept.test.ts"
+      - "showcase/scripts/bundle-setup-content.ts"
       - "showcase/shell-docs/package.json"
       - "showcase/shell-docs/package-lock.json"
       - "examples/integrations/ms-agent-framework-dotnet/**"
@@ -18,6 +29,17 @@ on:
       - "showcase/shell-docs/src/content/**"
       - "showcase/shell-docs/model-allowlist.json"
       - "showcase/shell-docs/src/lib/__tests__/ms-agent-dotnet-provider.test.ts"
+      # The setup-concept gate below reads snippets owned by the integration
+      # packages and by the docs-only snippet tree, so a new or edited snippet
+      # has to trigger this workflow. Before OSS-1036 neither path was listed,
+      # and the coverage ratchet never ran in CI at all.
+      - "showcase/integrations/*/docs/setup/**"
+      - "showcase/integrations/*/manifest.yaml"
+      - "showcase/shell-docs/src/lib/setup-content.ts"
+      - "showcase/shell-docs/src/lib/setup-concept.tsx"
+      - "showcase/shell-docs/src/lib/__tests__/frontend-tools-setup-coverage.test.ts"
+      - "showcase/shell-docs/src/lib/__tests__/setup-concept.test.ts"
+      - "showcase/scripts/bundle-setup-content.ts"
       - "showcase/shell-docs/package.json"
       - "showcase/shell-docs/package-lock.json"
       - "examples/integrations/ms-agent-framework-dotnet/**"
@@ -72,6 +94,47 @@ jobs:
         working-directory: showcase/shell-docs
         run: npm exec -- vitest run src/lib/__tests__/ms-agent-dotnet-provider.test.ts
 
+  setup-concept-coverage:
+    name: Framework setup-concept coverage
+    runs-on: depot-ubuntu-24.04-4
+    timeout-minutes: 15
+    permissions:
+      contents: read
+      id-token: write # zizmor: ignore[undocumented-permissions] Depot runner OIDC.
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+          cache: npm
+          cache-dependency-path: showcase/shell-docs/package-lock.json
+      - name: Install dependencies
+        run: |
+          cd showcase/scripts && npm ci --ignore-scripts
+          cd ../shell-docs && npm ci --ignore-scripts
+      # `generate-registry.ts` imports the catalog fold out of the harness tree,
+      # which resolves `js-yaml` by walking up from `showcase/harness/`. Point
+      # that at the already-installed scripts tree instead of installing the
+      # harness package a second time. Same step as showcase/shell-docs/Dockerfile.
+      - name: Link harness module scope
+        run: ln -s ../scripts/node_modules showcase/harness/node_modules
+      # The bundled snippets live in `src/data/setup-content.json`, which is
+      # gitignored, so the tests cannot run until it is generated.
+      - name: Generate registry and bundled content
+        working-directory: showcase/shell-docs
+        run: npm run pretypecheck
+      # Scoped to the two setup-concept files on purpose. The whole shell-docs
+      # suite is not green on main, so running it here would gate every snippet
+      # change on unrelated failures.
+      - name: Check every framework states its frontend-tool requirement
+        working-directory: showcase/shell-docs
+        run: |
+          npm exec -- vitest run \
+            src/lib/__tests__/frontend-tools-setup-coverage.test.ts \
+            src/lib/__tests__/setup-concept.test.ts
+
   doc-tests:
     runs-on: depot-ubuntu-24.04-4
     timeout-minutes: 15