refactor(commands): inline embedded .md help text and forbid the pattern

What does this MR do and why?

Four commands were sourcing cobra Long/Example help from sidecar .md files via //go:embed:

• internal/cmdutils/pipeline_inputs.md (shared by glab ci run and glab ci run-trig)
• internal/commands/cluster/graph/long.md
• internal/commands/project/members/add/long.md
• internal/commands/project/members/add/example.md

Every other command in the repo (hundreds of them) inlines help text via heredoc.Doc(...). The two files that started using the sidecar pattern landed independently and never turned into a convention.

The sidecar pattern also fell outside CI's markdown-lint glob (docs/**/*.md + repo-root *.md), so files like these silently accumulated MD041 (missing-first-line-heading) and other violations that only surface intermittently in local lefthook run pre-push when the file happens to appear in {push_files}. That's how !3725 (merged) got blocked by a lint failure on a file it didn't touch.

Changes

1. Inline all four sidecars into their respective command Go sources via heredoc.Doc — the same pattern used everywhere else. Delete the .md files and drop _ "embed" imports.
2. Add make check-embed — a grep guard that fails if any .go file under internal/ re-introduces //go:embed <name>.md. Wired into make check and lefthook's pre-push.
3. Document the rule as item 27 in the Command documentation block of .gitlab/duo/mr-review-instructions.yaml under a new Help text sources: subheading, so GitLab Duo Code Review also flags future occurrences.

Test plan

• make check passes (4474 tests, 0 lint issues, check-embed clean).
• Regex boundary check: matches //go:embed foo.md but not //go:embed foo.md.txt, //go:embed all:assets, or //go:embed registry.yaml.
• Regenerated docs/source/repo/members/add.md (single trailing blank line in Example block — natural output of heredoc.Doc without the removed strings.Trim).
• Post-merge: !3725 (merged) merges main to pick up the deletions, then its long.md‑blocked pre-push clears cleanly.

Follow-up

Once this lands, !3725 (Snap keyring hint) re-merges main to inherit the deleted sidecar files, which unblocks its pre-push pipeline.