Relink gate: refuse drift link on stale anchors unless explicitly reviewed

[laulauland]

Summary

drift link now refuses to restamp stale anchors. When a target's signature has changed, the command prints both sides — the doc section (spec) and the current code — then exits 1. The only way through is --doc-is-still-accurate, an explicit assertion that the doc was reviewed and doesn't need changes.

This prevents agents and humans from blindly relinking without reading what changed.

What happens on stale relink

For symbol anchors, drift prints the doc section and the current symbol body via tree-sitter. For heading anchors, it prints both heading sections. Output is capped at 10 lines per side.

── doc ── doc.md ##Authentication ──
The login function validates a username/password pair...

── code ── auth.ts#login (9 lines) ──
function login(username: string, password: string): string {
  ...
}
  STALE  auth.ts#login

refused: target changed since last link.
Review the doc, then relink with --doc-is-still-accurate.

Changes

• src/commands/link.zig — isDocGateBlocked checks staleness, printStaleContext shows both sides, printBlanketRefusal consolidates output for multi-anchor docs
• src/main.zig — --doc-is-still-accurate flag for the link command
• src/markdown.zig — extractHeadingSectionContent for heading target display
• .claude/skills/drift/SKILL.md, docs/CLI.md — updated documentation

Test plan

• zig build test passes
• drift link <doc> on stale anchor → prints context, exits 1
• drift link <doc> --doc-is-still-accurate → succeeds
• Multi-anchor doc → doc section printed once, stale bindings listed