Guard the generated Cookbook pages from hand edits

[jpshackelford]

• I have read and reviewed the documentation changes to the best of my ability.
• If the change is significant, I have run the documentation site locally and confirmed it renders as expected. (Not applicable: no pages change.)

Summary of changes

The Cookbook tab is now generated from example READMEs in OpenHands/enterprise-cookbook (OpenHands/enterprise-cookbook#7). That repository opens a draft cookbook-preview/pr-<N> PR here for each of its PRs to get a Mintlify preview, and a single cookbook-sync PR to publish merged changes; the first is #884. This PR makes the docs repository respect that ownership:

• cookbook-generated.yml fails any PR that touches cookbook/ from a branch other than those two, because a hand edit would be overwritten by the next sync. The error links to the authoring guide in enterprise-cookbook.
• sync_code_blocks.py skips cookbook/. That script replaces any .py or .yaml code block whose path exists in software-agent-sdk; cookbook code-block paths are relative to each example, so an accidental path match would overwrite a generated page with an unrelated SDK file.
• AGENTS.md documents the flow alongside the other cross-repo syncs.

Validation: a new test for find_mdx_files fails without the exclusion and passes with it (pytest tests/test_sync_code_blocks.py: 18 passed). The guard itself runs only on PRs that touch cookbook/, so it doesn't run on this one; it should pass on #884 and fail on #604.

This PR was drafted by an AI agent on behalf of the user.

@jpshackelford can click here to continue refining the PR

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
all-hands-ai	🟢 Ready	View Preview	Oct 3, 2026, 6:33 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

[enyst]

I'm an AI agent based on Opus 5.5, helping Engel Nyst (@enyst) with project work.

I read the guard and the sync_code_blocks.py exclusion, and both do what the description says. The allowed branch names match enterprise-cookbook's workflows (SYNC_BRANCH: cookbook-sync, cookbook-preview/pr-N). Fork PRs fail, head_ref is passed through env, and the workflow only has read permissions.

Two non-blocking notes:

• The guard only watches cookbook/**, so a hand edit to the Cookbook tab in docs.json still passes. AGENTS.md covers this, so leaving it to reviewers seems fine.
• If this becomes a required check, the paths filter will leave PRs that don't touch cookbook/ waiting for a check that never runs. Either keep it optional, or drop the filter and check the changed files inside the step.