Add CI validation for the cross-reference mapping files

[KrishnaTO]

Adds .github/scripts/validate_mappings.py and two workflows. No data changes.

Why these checks

Every rule here comes from something that already reached main:

Seen in	Problem
#49, #52	mesh:null, DOID:null — the editor wrote a missing id as a literal placeholder, caught by hand in review one row at a time
#57	ICD-9 codes filed under the icd10cm prefix, retired from the source list but not from the data
#51	MONDO:MONDO:0014523 — the prefix concatenated onto a value that already carried it
#60	140 ids curators had flagged wrong were still stored in the ontology and still served
throughout	the two exports drifting when a row round-trips through a spreadsheet: 362.50→362.5, 0111157→111157

Catching these by eye does not scale across three curators submitting through the editor.

What it checks

• Structure — header schema, column counts, stray tabs, mixed line endings, a byte-order mark, a prefix missing from the SSSOM curie_map.
• Identifiers — placeholders, doubled prefixes, ids that do not fit their vocabulary's shape, ICD-9 under icd10cm.
• Contradictions — the same pair recorded as both confirmed and flagged wrong, duplicate rows, one disease under two labels, future dates, unattributed edits.
• Agreement between the two exports, row for row.
• Agreement with the ontology — unknown disease id, stale label, an id flagged wrong that is still stored and still served, a confirmed id that was never stored.

Two workflows

Workflow	Trigger	Scope
Validate mappings	PRs touching mappings/ or ontologies/	only rows the branch added or rewrote — fails the check, findings land as annotations on the changed line
Audit mappings	Mondays 07:00 UTC, or on demand	every row

The gate is diff-scoped deliberately. A curator submitting one disease should not be blocked by debt they did not introduce, and main should not go red on every merge. The weekly audit is where the standing backlog lives.

Standard library only, so CI needs no install step, and it runs locally unchanged:

python .github/scripts/validate_mappings.py

Current state of the backlog

Against main as it stands: 193 errors, 17 warnings, all pre-existing. #61 and #62 clear the two bulk groups mechanically, taking it to 25 errors, 17 warnings.

What remains after those needs a curator rather than a script — 18 literal null ids, the MONDO:MONDO:0014523 double prefix, two MONDO values stored with a prefix where the other 55 are bare, the ICD-10 range I00-I02, and one drift where the SSSOM export has DOID:0111157 against the equivalencies export's DOID:111157.

Test plan

• Clean tree in diff-scoped mode reports zero, so pre-existing debt does not block a PR
• A synthetic PR carrying mesh:null, an ICD-9 code, a rejected-but-still-stored SNOMED id, a nonexistent ARI id, a stale label, a future date, a malformed author handle, a stray tab, and a row present in only one file — all caught, exit 1
• Both workflow files parse as YAML

Advances #23 ("Validate all diseases with database xrefs"); referenced rather than closed.

🤖 Generated with Claude Code