fix: correct Seal, compatibility, analytics and runtime-pin docs

[abrichr]

Four docs pages told readers things that the released software does not do. This change corrects them and adds a regression test for each one, so the same drift fails CI next time.

• The Seal pages told readers to run openadapt-flow replay bundle --seal. No Flow release has that option.
• The compatibility table gave package ranges that the newest openadapt and openadapt-flow releases no longer accept.
• Google Analytics on the docs ran under Do-Not-Track, left Google signals on, and sent the raw search text.
• Several pages called a Cloud runtime pin "current" when it was two releases out of date.

Fixes

Problem	Change	Regression test	Ref
seal.md, oem-brief.md and llms.txt told readers to run openadapt-flow replay bundle --seal (and openadapt flow replay bundle --seal). Flow 1.35.1 rejects the option with unrecognized arguments: --seal.	The pages now say that Execute issues the Seal for approved pilot partners, that the public CLI doesn't issue one yet, and that a replay option for it is planned. openadapt flow seal SOURCE --out DESTINATION is described as what it does: it copies a bundle and encrypts its workflow and template evidence. It doesn't issue a Seal.	tests/test_documented_flow_options.py checks the subcommand and long options of all 218 Flow commands that appear as code in the docs against the argparse parser of Flow 1.35.1 (tests/fixtures/flow_cli_1.35.1.json).	B209
docs/reference/compatibility.md said openadapt-flow >=1.7,<2, openadapt-capture >=1.1.0, and two openadapt-types ranges (0.7 and 0.9). The newest releases require Flow >=1.29,<2, Capture >=1.2.0,<2 and types >=0.17,<0.18, so following the table caused a resolver conflict.	The table states the current ranges and merges the two types rows into one. scripts/check_published_version_claims.py checks the table's structure on every PR. The daily run compares each range with live PyPI requires_dist and requires_python, and files an issue when they drift. validate_docs.py no longer requires the stale literal ranges.	tests/test_compatibility_table.py compares the committed table with a PyPI snapshot from 2026-10-14 and covers 8 failure cases.	B220
Material's Google Analytics script loaded gtag.js and set _ga cookies under Do-Not-Track. It left Google signals on and sent the search text as search_term. Both contradict ANALYTICS.md and the privacy policy.	overrides/partials/integrations/analytics/google.html replaces Material 9.7.7's partial. Under Do-Not-Track it loads nothing. It checks each DNT property separately, so one property set to "0" can't hide another set to "1". Every config command turns Google signals and ad personalization signals off. Search sends only query_length.	tests/test_docs_google_analytics.py builds the site and runs the page's analytics scripts in Node against a stub browser. It covers 4 DNT signals, mixed signals, no DNT, and the search event.	B221
The deployment matrix, hosted guide, security review and qualification page said "the current managed-runtime manifest pins Flow 1.31.0", with that release's commit and hashes. Cloud has pinned Flow 1.34.0 since 2026-08-28. oem-brief.md called openadapt-types 0.9.0 the released contract.	Each pin sentence now reads "As of 2026-10-14" and gives the 1.34.0 values. The release commit and wheel and sdist SHA-256 values appear only on the deployment matrix. They match PyPI and the v1.34.0 tag. The OEM guide links to the compatibility table for the types range.	tests/test_runtime_pins.py requires each pin sentence to be dated, to match docs/published-version-claims.json, and not to call the pin current. It also requires the matrix hashes to match the registry and every named openadapt-types release to fall in the table's range.	B226

Not fixed here

• Consent banner (B221). Visitors who don't send Do-Not-Track still get Google Analytics cookies without being asked. openadapt.ai has no consent banner either. ANALYTICS.md now says this plainly. Adding Material's extra.consent is a product decision.
• Blog analytics (B221). The blog still loads gtag.js under Do-Not-Track. That code is in the openadapt-blog repository.
• Docs auto-sync (B223). The code fix is already on main (fix: patch the docs XSS advisory and correct docs and ops claims #230). The repository has no DOCS_SYNC_APP_CLIENT_ID variable or DOCS_SYNC_APP_PRIVATE_KEY secret, so the sync job stops with its intended error and docs: auto-sync generated documentation #223 stays blocked.
• PostHog on the docs (B225). The code fix is already on main (fix: patch the docs XSS advisory and correct docs and ops claims #230). The NEXT_PUBLIC_POSTHOG_KEY Actions variable isn't set, so the published site loads no PostHog.
• Live Cloud pin comparison (B226). Nothing compares the registry with Cloud's runner/runtime-version.json automatically, because that repository is private. The pin sentences are dated, so they stay accurate until the date and registry are bumped.

How it was tested

• I made a temporary worktree at origin/main and copied in only the new test files and fixtures. For B220 I also copied in the new checker script, because the test imports it. All 4 new test modules failed for the documented reasons: the 4 --seal lines, the 6 stale table ranges, all 8 analytics cases, and the undated 1.31.0 pin sentences and types 0.9.0 mentions. With this branch's registry swapped in, the B226 hash test also failed on the 1.31.0 commit. All of them pass on this branch.
• I rebuilt the Flow 1.35.1 parser from build_parser() at tag v1.35.1, and it matches the fixture (82 subcommands, identical options). The PyPI fixture matches live PyPI for openadapt 1.16.0 and openadapt-flow 1.35.1. The 1.34.0 commit and hashes match openadapt-cloud origin/main and PyPI.
• pytest tests/: 541 passed, 1 skipped (the PostgreSQL drill, which needs OPENADAPT_TEST_POSTGRES_BIN).
• scripts/validate_docs.py, scripts/check_published_version_claims.py --require-network (including the new PyPI comparison), mkdocs build --strict and uv lock --check all pass. ruff check passes on every changed Python file. The existing ruff findings are in files this change doesn't touch.

Before merging

These are repository settings, not code:

1. B223: install a GitHub App on this repository with Contents: write and Pull requests: write permissions. Then set the Actions variable DOCS_SYNC_APP_CLIENT_ID and the secret DOCS_SYNC_APP_PRIVATE_KEY, and rerun or reopen docs: auto-sync generated documentation #223.
2. B225: set the Actions variable NEXT_PUBLIC_POSTHOG_KEY to the openadapt.ai project key. NEXT_PUBLIC_POSTHOG_HOST is optional.
3. B221: decide whether the docs and openadapt.ai should ask for consent before Google Analytics sets cookies.

🤖 Generated with Claude Code