ci: split an error-only vale check out of the full prose-lint job

mara, on #4128: add a CI step (separate from the existing one) that
only flags error-level vale hits, so it can be made a required check
without also gating merges on the pre-existing warning/suggestion
backlog. The full job stays as-is, advisory, for that backlog.

Also brought docs/scheduler/ci.md's CI-checks table back in sync with
reality (it was missing the doc-pointer lint job already; now lists
both vale jobs and their required-check status).

.forgejo/workflows/ci.yml

@@ -80,10 +80,29 @@ jobs:
         # `Packages` line) are fetched fresh from the Vale Package Hub each
         # run rather than vendored, so this job always lints against
         # upstream's current rules. Failing red on a hit is intentional --
-        # the existing docs/ tree has a real backlog against these rules
-        # (663 hits as of this writing), so this job starts out red on
-        # unrelated PRs until that backlog is worked down. Not (yet) wired
-        # into branch protection as a required check, so a red result here
-        # doesn't block a merge -- opting it into required-check status is
-        # a separate, later call.
+        # the existing docs/ tree has a standing backlog of warning- and
+        # suggestion-level rule hits, so this job stays red on unrelated
+        # PRs until that backlog is worked down (tracked separately from
+        # #4128, which was scoped to error-level hits only). Not wired
+        # into branch protection -- see the sibling job below for the
+        # error-only slice that is.
         run: XDG_DATA_HOME="$PWD/.vale-data" nix shell nixpkgs#vale --command sh -c 'vale sync && vale docs'
+
+  prose-lint-errors:
+    name: prose lint (vale, errors)
+    runs-on: [hive-ci]
+    # Own `vale sync` rather than reusing the sibling job's: each job gets
+    # a fresh checkout/environment, so there is nothing to share between
+    # them without an artifact-upload step this doesn't need.
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v3
+      - name: lint
+        # The error-level-only slice of the sibling job above.
+        # `--minAlertLevel=error` changes what vale both reports AND exits
+        # non-zero on, so this job's pass/fail tracks only error-severity
+        # rule hits, not the warning/suggestion backlog the sibling job
+        # carries. Split out (#4128) so this one alone can be a required
+        # check (forge branch protection) without blocking merges on the
+        # pre-existing backlog the sibling job still surfaces.
+        run: XDG_DATA_HOME="$PWD/.vale-data" nix shell nixpkgs#vale --command sh -c 'vale sync && vale --minAlertLevel=error docs'