docs: cross-link the 18 pages that nothing on the site links to #440

Eighteen hand-authored pages are in config/navigation.json and have zero inbound internal links from anywhere in the repo. They are reachable only by someone already scrolling the correct sidebar group, so neither a reader following a topic nor Mintlify search ranking can find them from the page where the question arises.

This is cross-reference rot — scripts/audit_navigation.py does not check it, because it only sees the navigation tree, not prose links.

The 18 pages

Three findings that make the pattern concrete

1. The newest page was born orphaned. tutorials/report_gke_envs landed yesterday in #436. getting_started/environments.md:61-63 is the page that lists reporting tutorials, and it still says:

You can follow one of the tutorials below to setup automatic snapshot reporting for your environment:
- [Kubernetes environment reporting](/tutorials/report_k8s_envs)
- [AWS ECS/S3/Lambda environment reporting](/tutorials/report_aws_envs)
- [Cloud Run environment reporting](/tutorials/report_cloud_run_envs)

Its three siblings each have three or more inbound links (getting_started/environments, labs/lab-05-runtime-controls:235, helm/k8s_reporter/karpenter:41, tutorials/repositories:132). Adding the fourth line is a one-line fix, and nothing in CI asked for it.

2. The largest hand-authored page on the site is unreachable by link. tutorials/working_with_controls is 3,286 words (per #396) and nothing links to it — not understand_kosli/controls, not getting_started/enforce_policies, not understand_kosli/risks.

3. Four of the seven troubleshooting pages have no inbound links. The three that do (repo_digest_unavailable, subshell_stderr, what_do_i_do_if_kosli_is_down) are linked from elsewhere; docker_api_version_error, github_kosli_api_token, whitespace_path and zsh_no_such_user are not. A troubleshooting page is the one page type a reader never browses to — they arrive from the page that produced the error.

Similarly, the naming_conventions group has three pages and only attestation_types is linked from anywhere; its overview and flows_and_trails siblings are not.

URL impact

None. No page files move, no navigation entries change, no headings are renamed. This is adding links to prose, so no config/redirects.json entry is needed.

What a fix looks like

Add one contextual link from each page in the right-hand column. Not a "See also" dump — a sentence where the subject actually comes up. The GKE line in getting_started/environments.md is the model: the sibling list already exists, the entry is just missing.

Worth doing alongside #395 rather than after it, since the same pages change hands there.

Evidence

Nav pages, minus generated trees, minus everything that appears as a link target anywhere in the repo:

# all non-generated page paths in navigation
grep -oE '"[a-z0-9_][a-zA-Z0-9_/-]*"' config/navigation.json | tr -d '"' | grep '/' \
  | grep -vE '^(client_reference/|helm/|terraform-reference/|github-action-reference/)' | sort -u

# all internal link targets in all content
grep -rhoE '\]\(/[a-zA-Z0-9_/.#-]+|href="/[a-zA-Z0-9_/.#-]+' --include=*.md --include=*.mdx . \
  | sed -E 's/^\]\(\///; s/^href="\///; s/#.*//; s|/$||' | sort -u

The difference is the table above. changelog/index and labs/index also appear in the difference and are excluded as false positives — both are linked by their tab path (/changelog, /labs).

Found by the monthly doc-structure audit, step 2 (cross-reference rot).