fix: the weekly model sync discarded the only changes worth reviewing

[skyoo2003]

Summary

The weekly Smithy sync was structurally incapable of surfacing the upstream change it exists to surface: its test step ended the job before Create Pull Request, and an upstream model that gains an operation is designed to fail that step. This PR fixes that, measures one real sync, and publishes what keeping 205 services current actually costs.

No service is added. The registered count stays 205.

Related Issue

Refs .claude/prds/aws-service-coverage-100.prd.md — Milestone 8, "Sustaining cost known and bounded". Closes the PRD's own largest open question, "What is the sustaining cost?", which had survived six milestones.

Changes

The defect, and why it hid for six milestones. go test ./... inside the sync includes the published-figure gate in cmd/devcloud/coverage_test.go. One new upstream operation moves the fidelity manifest and fails that gate — on purpose, so a human looks at a coverage change. But a failed step ends the job, so Create Pull Request never ran and the refreshed models died with the runner. A cosmetic sync produced a PR; a semantic one produced a red cron job with nothing attached. The mechanism that would answer "what does this cost?" deleted its own evidence, every time the answer mattered.

Confirmed by running it, not by reading the YAML:

--- FAIL: TestPublishedOperationTiersMatchTheManifest
    docs/coverage.md publishes 12407 known operations, the manifest holds 12660

• .github/workflows/smithy-sync.yml — the test step records its result instead of gating; the PR is opened whenever models moved; the swallowed failure is re-raised after the PR exists, so the cron cannot silently go green forever. The body is built from the churn summary via body-path.
• scripts/model_churn.py (new) — says which services gained or lost operations, which models moved only documentation, and how many upstream models are not vendored here. stdlib only, die() on a bad read, --self-check built in — mirroring scripts/demand_rank.py. It reads operation shape names and doc traits and nothing else; if it ever disagrees with codegen, codegen is right.
• cmd/devcloud/sync_test.go (new) — four guarantees over the workflow, in the same spirit as coverage_test.go gating docs/coverage.md: the asset is not Go, but a silent regression in it is invisible until the week it matters.
• docs/coverage.md — new "Keeping up with upstream" section carrying the measurement, its ceiling, and the command that re-derives it.
• docs/contributing.md — what a reviewer of a weekly sync PR is actually being asked to check.

What the measurement says — and what it does not

Refreshed all 194 vendored models against aws-sdk-go-v2 main on 2026-09-06:

Reading	Value
Models that changed	93 of 194
Of those, moved an operation	32
Of those, documentation-only	0
Net change in known operations	12,407 → 12,660
Generated files that moved	134

This is not a weekly rate, and the docs say so. The 93 that changed were vendored 141 days earlier; the other 101 were vendored the day before and none of them moved. So the figure is an accumulated backlog, and the only weekly-scale sample available reads zero.

What is settled is the shape of the work: no sync can be waved through as "AWS just reworded things", and every sync that moves an operation costs a human re-derivation of the published figures. What is not settled is the cadence. The plan pre-registered four outcomes; the measurement did not fit the one it was closest to, and that is recorded rather than rounded off.

Largest movers: ec2 +46 operations, glue +34, acm +23, sagemaker +22.

0 documentation-only over 141 days looked like a bug, so it was checked rather than trusted — the non-doc differences are real upstream trait additions (smithy.rules#endpointBdd, aws.auth#sigv4a), not nondeterminism.

Test Plan

TDD throughout — four RED→GREEN cycles, each checkpointed. Evidence in .claude/tdd/aws-service-coverage-100-milestone-8.tdd.md.

• 81878be RED → a69ace2 GREEN — a failing sync must leave a reviewable PR
• 8a03c77 RED (SKIP until applicable) → live assertion after the fix — the fix's own failure mode: continue-on-error alone would trade one silent no-op for another
• d4e4a6e RED (NotImplementedError) → a358448 GREEN — the churn readings
• 4a0e2ca RED → f2946bb GREEN — the summary reaches the PR body

Validation on the final tree:

CGO_ENABLED=0 go test ./...                       no failures
pytest tests/compatibility/                       1127 passed, 17 skipped
make codegen && git status internal/generated     0 drift
scripts/generate-imports.sh && git diff           clean
golangci-lint run                                 exit 0
python3 scripts/model_churn.py --self-check       self-check OK

Known gap, stated rather than papered over: the workflow change is verified statically against the YAML, not by a live workflow_dispatch run. That verification arrives with this PR's own CI.

Checklist

• Self-reviewed the code
• Added/updated tests
• Lint/format passes (golangci-lint run)
• Updated documentation (if applicable)
• Added a Changie changelog fragment for user-facing changes