ci: guarded-path list is duplicated in three places and can drift #45

The self-modification guarded-path list now lives in three places:

• the grep -E pattern at .github/workflows/ai-review.yml:96 (the one that actually gates)
• CONTRIBUTING.md § Automated PR review
• CLAUDE.md § AI PR review (Argus)

Extending the regex means remembering to update two docs, and nothing catches it if you don't. #43 already shipped one instance of exactly this drift: the docs omitted .github/workflows/validate-ai-review-config.yml, which the gate does cover.

Suggested fix: add a check to scripts/check-ai-review-workflow.cjs that parses the paths out of the grep -E pattern and asserts each one appears in both docs. The validator already extracts that pattern for its existing guarded-path assertions, so this is a small addition.

This could not be done in #43: scripts/check-ai-review-workflow.cjs is itself a guarded path, so touching it would have paused Argus and defeated that PR's purpose as the end-to-end proof for #41. It needs its own PR with a human reviewer.

Raised by Argus reviewing #43 (#43 (review)).