[auser]

What

The last two CI (main) runs (43523161932, 43535542677 on 50b1a23) fail three jobs: BDD conformance (2 scenarios), Test workspace (aarch64), and the "Require every lane to pass" meta-lane. This fixes all three causes.

1. TS doc example — operations-cookbook.mdx assigned MODE: "dev" as a bare string; feat(sdk): retire bare-string env values in the SDKs and decorator parser (#4839) #5463 made EnvValue explicit, so the documented example fails the typecheck scenario (TS2322). Now MODE: literal("dev") with literal imported.
2. Docs coverage ledger — mvmctl policy validate ./policy/api-group.toml (documented in the policies guide) sat outside the coverage ledger, and the ratchet failed on it before reaching stale debt behind it. Adds a scenario staging the guide's own group file in a scratch directory and validating it offline (--verbose so the success line is observable), then regenerates the ledger: the three policy validate examples move uncovered → covered, and entries whose doc lines recent PRs removed leave the ledger.
3. aarch64 pty EIO — a_console_spawned_shell_holds_no_capabilities read the pty master with read_to_end, which propagates EIO. EIO is how a Linux pty master reports that every holder of the slave side has closed it, so a fast-exiting sh -c grep failed the read on the aarch64 runner (x86_64 timing masks the race). The read loop now treats EIO as end of stream, matching pump_output's documented contract.

Validation

• s29 doc-examples suite: 25 scenarios / 52 steps, all passed (was 2 failed)
• just check::gated (linux-gated + bdd targets): clean
• scoped clippy (mvm-agentd --tests, mvm-conformance --features bdd --tests): -D warnings clean
• The aarch64 capability test itself needs a privileged Linux host; the failure mode and fix are verified by inspection against pump_output's EIO handling, and the job will re-witness on this PR's aarch64 runner.

Lifecycle

Test-only/doc-only change; no runtime state transitions touched. The new scenario owns a tempdir scratch dir + isolated home, dropped on process exit as the existing steps do.

Refs #5369

[auser]

Superseded by #5511: this PR never received a pull_request event from GitHub (zero workflow runs across two pushes, a close/reopen, and no path filters in ci.yml), so its checks could never run. Same commits on a fresh branch in #5511.