The allowlist that a fallback was hiding

PR #3639 added a /rss.xml route handler to the docs site but not its entry in SERVED_EXACT (docs/site/lib/agent-404.ts). Production would have served the feed anyway, because isServedPath() has an extension fallback that treats a dotted path as served. The drift guard in __tests__/agent-404.test.ts exists precisely because that fallback masks omissions, and it did its job: Docs Site Build went red on the merge commit. This PR is the missing line.

Why the guard cannot trust production behavior

route file exists          ──▶ Next.js serves /rss.xml            ✓ works in prod
SERVED_EXACT missing it    ──▶ isServedPath() extension fallback  ✓ still "works"
                               └─ so the omission is INVISIBLE at runtime
agent-404 drift test       ──▶ reads app/ dirs directly           ✗ FAILS (correct)

The same class caught /api-policy.md drifting in #2385. A check that can only observe the fallback would answer the same whether or not the entry exists, so it would be no evidence at all.

Try the rule

What the allowlist holds today

EntryKind
/auth.md, /api-policy.md, /pricing.mdmarkdown twins
/llms.txt, /llms-full.txtagent-readable exports
/rss.xmlrelease feed (added here)
/schema-map.xml, /robots.txtcrawler surfaces