fix(11.1-07): find src= fences in the goldmark AST and refuse nested ones

- collectFences walks every fenced code block the renderer parses
- a nested src= fence is refused and is not extracted, synced or captioned
- checkSnippets runs on the same parse as the other checkers
- Sync rewrites drifted top-level fences and keeps the frontmatter

Deviation: TestSyncRewritesDrift's drifted src= fence sat inside a list item, which is now refused. The drift case is a two-space top-level fence so Sync still rewrites it (problem line 11).

internal/docsite/docsite.go

@@ -233,18 +233,23 @@ func writeOutputs(out string, files map[string][]byte) error {
 }
 
 // checkContent runs the accuracy checkers over every page and the root
-// README.md: module identifiers, links and anchors, command names,
-// consuming-application names in the sources, and the fence, callout and
-// heading policy.
+// README.md: src= snippets, module identifiers, links and anchors,
+// command names, consuming-application names in the sources, and the
+// fence, callout and heading policy.
 func (s *site) checkContent() ([]Problem, error) {
 	docs, err := s.parseDocs()
 	if err != nil {
 		return nil, err
 	}
-	idx, problems, err := buildIdentIndex(s.opts.Root)
+	problems, err := s.checkSnippets(docs)
 	if err != nil {
 		return nil, err
 	}
+	idx, more, err := buildIdentIndex(s.opts.Root)
+	if err != nil {
+		return nil, err
+	}
+	problems = append(problems, more...)
 	problems = append(problems, s.checkIdentifiers(idx, docs)...)
 	problems = append(problems, s.checkLinks(docs)...)
 	cp, err := s.checkCommands(docs)