fix(11.1-07): find src= fences in the goldmark AST and refuse nested ones

- collectFences walks every fenced code block the renderer parses
- a nested src= fence is refused and is not extracted, synced or captioned
- checkSnippets runs on the same parse as the other checkers
- Sync rewrites drifted top-level fences and keeps the frontmatter

Deviation: TestSyncRewritesDrift's drifted src= fence sat inside a list item, which is now refused. The drift case is a two-space top-level fence so Sync still rewrites it (problem line 11).

internal/docsite/docsite_test.go

@@ -325,7 +325,9 @@ func TestSnippetConfinement(t *testing.T) {
 }
 
 func TestSyncRewritesDrift(t *testing.T) {
-	doc := page("Start", "setup", 10, "Intro.\n\n- In a list:\n\n  ```go src=pkg/lib.go#Greeting\n  func stale() {}\n  ```\n\n"+
+	// Two leading spaces stay a top-level fence. A src= fence inside a
+	// list item is refused, so this drift case is not one.
+	doc := page("Start", "setup", 10, "Intro.\n\n  ```go src=pkg/lib.go#Greeting\n  func stale() {}\n  ```\n\n"+
 		"```yaml src=config/app.yaml#db\ndb:\n  host: localhost\n```\n\nOutro.\n")
 	root := snippetTree(t, map[string]string{"docs/setup/start.md": doc})
 	path := filepath.Join(root, "docs/setup/start.md")
@@ -334,7 +336,7 @@ func TestSyncRewritesDrift(t *testing.T) {
 	if err != nil {
 		t.Fatal(err)
 	}
-	want := "docs/setup/start.md:13: snippet: body differs from pkg/lib.go#Greeting (run: summer docs:sync)"
+	want := "docs/setup/start.md:11: snippet: body differs from pkg/lib.go#Greeting (run: summer docs:sync)"
 	if got := problemLines(problems); !slices.Equal(got, []string{want}) {
 		t.Fatalf("problems = %q, want [%q]", got, want)
 	}