test(11.1-06): plant one fixture per docs checker rule and run them in the gate

- testdata/clean passes every check; 63 violation cases each overlay one
  fault and a want.txt naming the single problem it must produce
- TestPlantedViolations also plants the forbidden name (split literals)
  and symlink escapes at run time; TestBuildOutputGuard covers --out
- check-phase11.1.sh --self-test runs the corpus through a go test -json
  detector that refuses FAIL, SKIP, zero tests and no tests to run
- the self-test scratch copy now carries examples/ and README.md, so its
  baseline sees the example command literals the real tree sees

internal/docsite/testdata/violations/snippet-nested-module/docs/extras/faq.md

@@ -0,0 +1,20 @@
+---
+title: FAQ
+description: "Questions about the demo."
+section: extras
+order: 20
+---
+# FAQ
+
+## Does it migrate
+
+Yes, run `./bin/demo migrate`, then `summer docs:sync` after a source change.
+
+```text
+summer not:checked in a text fence
+```
+
+```go src=nested/x.go#X
+// X is x.
+const X = 1
+```

internal/docsite/testdata/violations/snippet-nested-module/nested/go.mod

@@ -0,0 +1,3 @@
+module example.com/nested
+
+go 1.27.0

internal/docsite/testdata/violations/snippet-nested-module/nested/x.go

@@ -0,0 +1,4 @@
+package nested
+
+// X is x.
+const X = 1

internal/docsite/testdata/violations/snippet-nested-module/nested/x_test.go

@@ -0,0 +1 @@
+package nested

internal/docsite/testdata/violations/snippet-nested-module/want.txt

@@ -0,0 +1,3 @@
+rule: snippet
+file: docs/extras/faq.md
+message: path is inside the nested module nested/go.mod