docs(iceberg): document how location.catalog is classified (forge-cli #707)

[fas89]

Summary

Companion docs for forge-cli #707 ("fix(iceberg): one catalog-kind table, so every emitter agrees on location.catalog").

#707 replaces each emitter's hand-written reading of binding.location.catalog with one table of catalog kinds. This PR documents that table and corrects the pages that describe the old partition. It documents only what #707 ships. Nothing from the held-back Lakekeeper branch is here: no /catalog uri warning, no warehouse-must-be-a-name error, no lakekeeper/polaris in the sink.catalog enum, and no sink.catalogAuth.

#707 is in no release yet: forge-cli 0.19.0 is the latest tag, and it predates #707. So every new statement is marked (forge-cli #707, unreleased), and the 0.19.0-and-earlier behaviour is stated beside it. The site still tracks 0.18.1, and readers on that version need the old behaviour too.

Related CLI PR

• CLI PR: fix(iceberg): one catalog-kind table, so every emitter agrees on location.catalog forge-cli#707

Pages changed

Page	Change
advanced/source-aligned-acquisition.md	New section, Iceberg catalogs (location.catalog). It covers: - a Lakekeeper example (binding, the validate error without uri, the derived Kafka Connect catalog keys, the AWS module); - the spelling-folding rule and the platform defaults; - the unknown-value and sink.catalog refusals; - a per-kind table (sink selector, dbt catalogs.yml on Snowflake, Snowflake module, AWS module, streaming-sink requirements); - the Kafka Connect catalog-impl XOR type fix; - the AWS behaviour for a non-Glue table; - the iceberg_catalog_move_blocked upgrade path with the tofu state rm shape; - the other commands, and what 0.19.0 and earlier did. One sentence on sink.catalog under "Where the build lands data".
providers/snowflake.md	The catalogs.yml external/managed list (adds lakekeeper, bigquery, iceberg_rest; hive/jdbc/hadoop/dynamodb left out and refused), the apply prerequisites, the --strict CI note, and policy compile for an Iceberg expose.
cli/validate.md	New section, Iceberg catalog checks: what validate now refuses, and that a gate crash now fails validation. A follow-up line under the 0.14.0 --strict warning.
cli/generate-iac.md	The aws row of the provider table (no Glue table for a non-Glue Iceberg expose). The Snowflake --strict caveat now covers every REST kind, and hive/jdbc/hadoop/dynamodb are an error.
cli/apply.md	New Iceberg catalog-move guard subsection under Safety gates, and an iceberg_catalog_move_blocked row in "Errors you can hit".
cli/diff.md	An AWS Iceberg expose in a non-Glue catalog is not_checked, not looked up in Glue.
providers/aws.md	The binding-format table, the governance refusal note, the accessPolicy.grants warning and policy compile for a non-Glue Iceberg expose, and a line in "Upgrading an existing AWS contract".
providers/gcp.md	An expose naming a catalog other than bigquery is left out of catalogs.yml, and validate accepts its warehouse name.

No page moved, and no heading was renamed or removed. forge_docs URLs and anchors are a CLI contract (_DOC_ROUTES), so this PR only adds headings: 9 in the acquisition page, 1 in validate.md and 1 in apply.md.

How the claims were checked

Every behavioural claim traces to #707's CHANGELOG [Unreleased] entries or to its code at head 05dbe18b.

These outputs were produced by running forge-cli at 05dbe18b, not written by hand:

• the example contract and the fluid validate outputs;
• the derived Kafka Connect configs;
• the fluid generate iac result;
• the policy-compile warnings;
• the iceberg_catalog_move_blocked message and its tofu state rm commands.

A script also ran every emitter over every kind to fill the per-kind table: the sink, dbt catalogs.yml, the Snowflake and AWS modules, and validate.

The "0.19.0 and earlier" statements were checked against the v0.19.0 tag. That tag is an ancestor of #707's base.

Areas Updated

• Getting Started
• CLI Reference
• Provider Docs
• Walkthroughs / Examples
• Contributing / Community Docs
• Other (advanced/source-aligned-acquisition)

Checklist

• I previewed the change locally with npm run docs:dev or built it with npm run docs:build
• I checked links, page titles, and navigation where relevant
• Screenshots or command output are updated if needed (n/a: no screenshots; command output is from forge-cli at #707's head)

Checks run locally:

Check	Result
npm ci && npm run docs:build	pass. Node 25 locally; CI uses Node 20.
node scripts/check-dist-links.mjs	clean: 137,783 references, 242 pages
base-prefix check (copied from link-check.yml)	clean
lychee --offline source check (mirror and canaries copied from link-check.yml; lychee 0.24.2)	0 errors, canaries good=0 and bad=2
python scripts/check_cli_docs.py, with data-product-forge==0.18.1 installed	pass, including the flag oracle and the version sweep
python scripts/check_providers.py	pass
python scripts/gen_contract_reference.py --check	pass
Every new in-page anchor	each one resolves to an id in the built HTML

Notes

• Merge with, or after, forge-cli #707. If #707 changes before it merges, these pages need the same change.
• When the release that contains #707 ships, the docs track PR for that release should replace "(forge-cli #707, unreleased)" with the version. Grep for forge-cli/pull/707.