fix(11.1-07): find src= fences in the goldmark AST and refuse nested ones

- collectFences walks every fenced code block the renderer parses
- a nested src= fence is refused and is not extracted, synced or captioned
- checkSnippets runs on the same parse as the other checkers
- Sync rewrites drifted top-level fences and keeps the frontmatter

Deviation: TestSyncRewritesDrift's drifted src= fence sat inside a list item, which is now refused. The drift case is a two-space top-level fence so Sync still rewrites it (problem line 11).

internal/docsite/render.go

@@ -59,12 +59,20 @@ func (fenceAnnotator) Transform(doc *ast.Document, reader text.Reader, pc parser
 		if !entering || !ok || fc.Info == nil {
 			return ast.WalkContinue, nil
 		}
+		// Captions only on the fences checkSnippets compares: top-level
+		// src= fences of docs/ pages. A nested or module README fence is
+		// not verified, so it must not claim a source.
+		verified := pctx != nil && pctx.page != nil && pctx.page.Module == "" &&
+			fc.Parent() != nil && fc.Parent().Kind() == ast.KindDocument
+		if !verified {
+			return ast.WalkContinue, nil
+		}
 		ref, ok := ParseSrc(string(fc.Info.Segment.Value(src)))
 		if !ok {
 			return ast.WalkContinue, nil
 		}
 		fc.SetAttributeString("data-src", []byte(ref.String()))
-		if pctx != nil && pctx.site.cfg.SourceURL != "" {
+		if pctx.site.cfg.SourceURL != "" {
 			fc.SetAttributeString("data-href", []byte(strings.ReplaceAll(pctx.site.cfg.SourceURL, "{path}", ref.Path)))
 		}
 		return ast.WalkSkipChildren, nil