Implement tools/generate-main-readme.sh (currently a no-op stub)

[tungbq]

Not tied to a labeled issue — found this by reading ROADMAP.md's Automation section ("Auto-generate topics table in README from directory structure") and noticing tools/generate-main-readme.sh is a literal no-op (echo "hehe, to be implemented"), already wired into a daily cron (main.yaml) that currently does nothing useful.

Summary

• tools/generate-main-readme.sh — diffs topics/ on disk against README.md's HTML table and appends a row for anything missing. Deliberately conservative: it auto-fills only what's mechanically certain from the filesystem (display name, folder link, whether basics//practice/ exist), and leaves the official docs link and icon as visible <!-- TODO --> placeholders rather than guessing — a wrong guessed link is worse than a flagged gap. Icon lookups against skillicons.dev are verified, not assumed: it silently serves a ~256-byte blank SVG for any slug it doesn't recognize (I hit this for real adding the fluxcd topic), so the script checks response size before using a URL.
• --check mode exits non-zero without touching README.md — for CI.
• .github/workflows/check-readme-topics-table.yml — runs --check on any PR touching topics/** or README.md, so a topic added without a table row fails the PR instead of silently drifting (which is exactly the mistake the next finding shows already happened twice).
• Running it against the actual repo immediately found two real, pre-existing gaps: backstage and ssh are complete topic folders (backstage even has basics/+practice/) with zero README.md table row and zero mkdocs.yml nav entry. Fixed both by hand: real docs links, a GitHub-avatar icon for Backstage (skillicons.dev has none, same as FluxCD/ArgoCD), a plain 📖 for SSH matching the existing icon-less-topic precedent (Architecture), added topics/ssh/practice/README.md (the topic had no practice content at all), and added both to mkdocs.yml's nav under "Other Tools". Left topics/index.md alone — it's already a curated subset (41 cards vs 47 topic folders, e.g. virtualbox isn't there either), not a 1:1 mirror, so "complete" doesn't apply there the same way.
• ROADMAP.md: checked off the now-done Automation item.

Test plan

• bash tools/generate-main-readme.sh --check on the now-fixed README — ✅ Every topic under topics/ already has a README.md table row.
• Verified the generator against real repo state, not a synthetic case — it found backstage/ssh on its very first run, confirmed both gaps are real by grepping README.md directly.
• Idempotent: re-running after fixing produces zero further diffs.
• shellcheck tools/generate-main-readme.sh — clean (fixed one real SC2318: local a=1 b=$a in one statement doesn't reliably see a's new value — split into separate local lines).
• mkdocs build --strict — identical 5 pre-existing warnings as main (root/topics/ README-vs-index.md conflicts, two pre-existing broken image links in argocd/elk), nothing new from this PR's mkdocs.yml change.
• Caught and fixed a real footgun in the script itself before shipping: the temp-file swap was silently stripping README.md's file mode (which happens to be 755 in this repo already, an unrelated pre-existing quirk) — added chmod --reference before the mv so the tool never does that to anyone.