Add CI drift check between api-sources/crmscript and the generated reference

[digitaldiina]

Surfaced while writing #135's contributor doc (contribute/how-to-update-crmscript-reference.mdx). There's no automated check today that catches api-sources/crmscript/*.yml being edited without the corresponding en/automation/crmscript/reference/*.mdx being regenerated to match — or the reverse: someone hand-edits the generated .mdx directly, and the next real regeneration silently clobbers their fix, since transform-crmscript.ps1 always overwrites the whole folder from source.

• Add a CI check (or PR-triggered workflow) that runs when a PR touches api-sources/crmscript/** and fails if the generated en/automation/crmscript/reference/** output wasn't regenerated to match.
• Consider also flagging PRs that touch the generated .mdx directly without a corresponding source .yml change, since that content is silently overwritten on the next real regeneration.
• Bundle transform-crmscript.ps1 + generate-crmscript-nav.ps1 + verify-nav-paths.py into one wrapper script (mirroring migrate-folder.ps1's own multi-step orchestration convention), so contributors and CI have a single command instead of three — reduces the chance of a partial run.

Natural fit once Tony's Phase 4 API/DB reference pipeline work is further along, since that pipeline will need the same kind of drift-safety.