lab/: pre-deletion checklist for everything outside lab/ that points into it

[jeremi]

Found during the 2026-07-07 architecture audit.

Context

lab/ is scheduled for deletion before 1.0 (replaced by the greenfield Solmara lab in its own repo). The audit mapped what breaks OUTSIDE lab/ on deletion day. Deleting the directory without this checklist breaks public docs, the submodule setup, and one open ticket's plan.

Checklist

• Submodules: all three git submodules live under lab/vendor/ (crosswalk, registry-atlas, esignet-relay-authenticator) with .gitmodules entries. Deleting lab/ must remove/relocate them; after that, the external pins live only in the release manifests. Verified: release/scripts/check-release-source-model.sh:374-376 self-disables its lab/vendor gitlink cross-check when the gitlinks vanish, and REQUIRED_EXTERNALS still forces manifests to pin the refs, so the release check survives by design.
• Public docs: 10+ docs/site pages instruct readers to use lab/ (quickstart.mdx, credential-tour.mdx, getting-started-fhir-evidence.mdx, plus data YAML/generated JSON). These break for readers the moment lab/ disappears; retarget them to the replacement lab.
• Root docs: README and AGENTS.md document cd lab && just quick and just release-fast.
• Stand up OpenID conformance suite runs against the lab topology #205 (conformance runs) targets the lab topology being deleted; retarget its plan.
• CI tidy: .github/workflows/ci.yml:91 path filter references lab/vendor / .gitmodules (stale-but-harmless after deletion).

Cleared during the audit (no action): relay test files' lab/ mentions are string literals in rate-limit identities, not filesystem dependencies.

Acceptance

• The deletion PR (or a preceding PR) covers every item above; no public docs page references lab/ afterward.

[jeremi]

Docs inventory update after the overhaul merge: quickstart and the credential tour no longer instruct readers into lab/ (they use the hosted lab with a solmara-lab fallback), and the first-run tutorial now targets solmara-lab. The public-docs checklist item reduces to the DHIS2 and FHIR tutorials (#257) plus any data YAML/generated JSON references; re-inventory before the deletion PR. The submodule item is unchanged; note the FHIR tutorial's troubleshooting documents a lab/vendor submodule command that breaks on deletion day.