validate: make docs validation deterministic

hack/dockerfiles/docs.Dockerfile

@@ -21,7 +21,7 @@ RUN --mount=target=/context \
   --mount=target=.,type=tmpfs <<EOT
 set -e
 rsync -a /context/. .
-docsgen --formats "$FORMATS" --source "docs/reference" --bake-stdlib-source "docs/bake-stdlib.md"
+docsgen --formats "$FORMATS" --source "docs/reference/" --bake-stdlib-source "docs/bake-stdlib.md"
 mkdir /out
 cp -r docs/reference docs/bake-stdlib.md /out
 rm -f /out/reference/*__INTERNAL_SERVE.yaml /out/reference/*__INTERNAL_SERVE.md
@@ -35,12 +35,17 @@ RUN --mount=target=/context \
   --mount=target=.,type=tmpfs <<EOT
 set -e
 rsync -a /context/. .
-git add -A
-rm -rf docs/reference/* docs/bake-stdlib.md
-cp -rf /out/* ./docs/
-if [ -n "$(git status --porcelain -- docs/reference docs/bake-stdlib.md)" ]; then
+
+# Replace checked-in docs with freshly generated output and ensure this does not
+# leave the repository dirty, matching the contract of `make docs`.
+rm -rf docs/reference
+cp -r /out/reference docs/reference
+cp /out/bake-stdlib.md docs/bake-stdlib.md
+
+git add -A docs/reference docs/bake-stdlib.md
+if ! git diff --cached --quiet; then
   echo >&2 'ERROR: Docs result differs. Please update with "make docs"'
-  git status --porcelain -- docs/reference docs/bake-stdlib.md
+  git diff --cached
   exit 1
 fi
 EOT