[netomi]

Follows #2194.

Documents 43 of the 83 properties the check tolerates as undocumented, leaving the 40
ovsx.scanning.* ones for a change of their own: they are a feature in their own right and better
reviewed by someone who knows it.

family	count		family	count
ovsx.caching.*	10		ovsx.migrations.*	2
ovsx.rate-limit.*	8		ovsx.data.mirror.*	2
ovsx.trusted-publishing.*	6		ovsx.publishing.*	2
ovsx.access-token.*	4		nine singles	9

How the facts were gathered

Not read off by hand:

• Defaults come from config-properties-report.sh, the same scanner the check uses.
• The release is the first tag containing the commit that introduced each binding, found with
  git log -S over the file that binds it - the key itself for a @Value, the camelCase field name
  for a @ConfigurationProperties field. All 43 resolved; I spot-checked several against the
  history.
• The prose is adapted from the javadoc on the config classes, which AGENTS.md already
  requires to document each property.

Twenty are in no release yet and say Unreleased. That is honest on main and self-correcting
in review, but wants replacing with the number when they ship - the largest groups are
ovsx.trusted-publishing.* and the ovsx.access-token.token-hash-* family.

Three new sections

Rate Limiting and Trusted Publishing are whole features with no section at all. CORS is
one property that belongs to neither the Web UI nor the Caching section it sits between.

The ratchet works

The baseline goes from 83 undocumented lines to 40, and the check refused to let me leave a stale
line behind - documenting the first 18 made it fail with "listed as undocumented in the baseline
but are now documented" until I deleted them.

203 properties bound, 168 documented, 45 gaps tolerated by the baseline.

All 174 property blocks in the reference were checked to have a well-formed Type and
Compatibility row.

A correction to #2191

Its description claimed that "nothing under ovsx.publishing. is bound any more
(require-license, unsupported-icon-formats)". That was wrong: PublishingConfig binds them via
@ConfigurationProperties("ovsx.publishing"), which the crude ${...} grep behind that figure could
not see. The scanner always saw them correctly, so neither the check nor the baseline was ever
affected - only that sentence in a merged description.

Prepared with Claude Code.