Map the renewal anchor, and pin only the repository that dispatched

[mervin008]

What this changes

Fixes two ways the sync workflow has been failing. In both, the whole-page sync committed fine, but the API guides and the route table stopped being published.

1. Missing anchor mapping (3 runs since Refuse to renew a certificate whose key CertPilot does not hold certpilot#114):
   • Error: sync-guides: certificates links to #asking-for-one, which is not a heading in that section and has no entry in ANCHOR_TO_PAGE.
   • Cause: the link is valid in certpilot, where the API reference is one page. Here the reference is split into pages, and that heading is on the renewal-queue page.
   • Fix: one ANCHOR_TO_PAGE entry, which is the designed place for this.
2. Wrong pin after an agent merge (run 36064618794, 24 September):
   • Error: sync-routes: …/certpilot/1d78e23…/docs/routes.json returned 404. 1d78e23 is a certpilot-agent commit.
   • Cause: the pages step already pins only the repository that dispatched, but the routes and guides steps pinned certpilot to whatever SHA arrived.
   • Fix: those two steps now use the same expression as the pages step, so an agent merge reads certpilot at main.

How it was verified

• A local sync with CERTPILOT_REF at certpilot main (8103195):
  • sync-routes is up to date (126 routes);
  • sync-guides completes, writing 14 guides, where it used to exit early.
• The site builds, and check:links finds 9091 links across 72 pages, none dead. The certificates page links to /api/reference/renewal-queue#asking-for-one, which exists.
• Not committed: the local sync output. The workflow's own "Refresh the route table and guides" PR carries it after this merges.
• actionlint is clean on sync.yml.

Not verified: a real agent dispatch through the fixed workflow. That happens on the next agent merge.

🤖 Generated with Claude Code