Rewrite summary-rendering check with AST-aware tokenizer

Addresses 15 issues from the multi-angle code review. The previous
regex scanner had real correctness gaps and ergonomic limitations.

Bugs the old scanner had:

1. Brace inside string literals (e.g. `{{ printf "{%s}" .Params.summary }}`)
   silently skipped the action — the naive `{{[^{}]*}}` regex stopped
   at the inner `{`.
2. Positional renderSummary regex matched when `.Params.summary` was
   nested in a non-RenderString call: `{{ .RenderString (printf "%s"
   .Params.summary) }}` falsely passed.
3. Piped renderSummary regex matched any later `.RenderString`
   mention: `{{ .Params.summary | print "x" .Page.RenderString }}`
   falsely passed because `.RenderString` appears after the pipe.
4. ifPredicate anchored to exact `if .Params.summary`, so compound
   forms (`if and .Params.summary $cond`) and `else if` were flagged
   as violations even though they only check presence.
5. Variable assignment `{{ $s := .Params.summary }}` was flagged
   indiscriminately; subfield access `{{ if .Params.summary.X }}`
   was flagged because the predicate regex required exact end.
6. Hugo comments mentioning the field (`{{/* .Params.summary */}}`)
   were treated as live references.

The new scanner:

- Tokenizes actions with quote-aware lexing (handles double-quoted
  and backtick strings; `{` and `}` inside strings no longer split
  actions) — fixes #1.
- Strips `{{/* ... */}}` comments before scanning (preserves line
  numbers via newline padding) — fixes #6.
- Classifies each action by leading keyword. `if` / `else if` /
  `range` are presence predicates regardless of compound form or
  subfield access — fixes #4 and the subfield case. `with` /
  `else with` are flagged as rebinding the dot.
- Pipeline analysis: splits on `|` at paren-depth 0, walks each
  stage. `.Params.summary` is safe only when it is a top-level
  positional argument to `.RenderString` or the head of a pipeline
  whose terminal stage is `.RenderString`. Nested references inside
  parens are flagged — fixes #2 and #3.

Other fixes in this commit:

- `baseof.html` exemption is now by relative path
  (`_default/baseof.html`), not basename. Hugo idiomatically
  supports per-type baseof overrides; basename-only would silently
  exempt all of them.
- The walker collects I/O errors into a side slice and continues,
  so a transient ReadFile failure on one file no longer masks
  every violation in the remaining files.
- `layoutsPath` deleted; the walk calls the existing `repoRoot(t)`
  helper from messaging_test.go.
- Three duplicated regex blocks collapsed into package-level vars
  and a single `scanSummaryViolations` helper. The multi-line test
  no longer round-trips through a tempfile.
- baseof.html's meta description pipes the summary through
  `$.RenderString (dict "display" "inline") . | plainify` so
  backticks become `<code>` HTML and then plain text. SEO
  snippets ship clean prose instead of literal Markdown
  punctuation.
- The pipe-form alternation (YAGNI in the previous regex) is
  generalized by the pipeline walker; no current template uses
  the piped form but the scanner handles it correctly when one
  does.

Verified by: 19-case `TestClassifyAction_TableDriven` covering
every safe and unsafe shape, plus three scenario tests
(`TestFindActions_BalancedStrings`,
`TestScanSummaryViolations_CommentsIgnored`,
`TestScanSummaryViolations_MultiLineWith`,
`TestScanSummaryViolations_BraceInString`). The real-layout walk
(`TestSummaryFrontMatterRenderedThroughRenderString`) passes
against the current `website/layouts/` tree, and the rendered
meta description on the progressive-disclosure page now shows
"Use <?catalog?> ..." rather than "Use \`<?catalog?>\` ...".

docs/development/website-config.md updated to enumerate the safe
and forbidden forms and explain the baseof.html meta-description
plainify path.

https://claude.ai/code/session_01Ly1xEwP5pfsLrtTCTKBQE3

Author: claude

docs/development/website-config.md

@@ -103,33 +103,56 @@ text, edit the source file and run the sync.
 ## Summary front-matter rendering
 
 Each docs page carries a `summary` front-matter field.
-The field holds inline Markdown. The templates render it
+The field holds inline Markdown. Templates render it
 through Hugo's `.RenderString` so backticks become
 `<code>` and `[text](url)` becomes `<a>`.
 
 A Go test in [`template_summary_test.go`][tpl-test]
-walks `website/layouts/**/*.html`. Each template action
-that references `.Params.summary` must take one of three
-forms. The forms are the predicate
-`{{ if .Params.summary }}`, the negated predicate
-`{{ if not .Params.summary }}`, or any action that calls
-`.RenderString`.
-
-Any other shape fails the test. The regression this
-guards against is
-`{{ with .Params.summary }}...{{ . }}{{ end }}`. The
-`with` rebinds the dot to the summary string. The inner
-`{{ . }}` then emits the value raw. A value with
-backticks ships as literal backticks instead of `<code>`
-tags. The bare `{{ .Params.summary }}` form carries the
-same defect without the rebinding.
-
-`baseof.html` is exempt. Its meta-description fallback
-emits plain text on purpose; the `<meta>` tag does not
-accept HTML.
-
-The test scans each file as one string, not line by
-line. A multi-line action that spans newlines is still
-caught.
+walks `website/layouts/**/*.html`. The scanner
+classifies every template action that mentions
+`.Params.summary`. It tokenizes actions itself and
+respects quoted strings, so braces inside string
+literals do not hide an action from the scan.
+`{{/* ... */}}` comments are stripped first so a
+comment that mentions the field is not flagged.
+
+Safe forms:
+
+- A presence predicate that does not emit output:
+  `{{ if .Params.summary }}`, `{{ if not .Params.summary }}`,
+  the compound forms `{{ if and .Params.summary $cond }}`
+  and `{{ if or .Params.summary $other }}`, the `else if`
+  variant, and subfield access such as
+  `{{ if .Params.summary.HTML }}`.
+- A `.RenderString` call where `.Params.summary` is a
+  top-level positional argument:
+  `{{ .RenderString (dict "display" "inline") .Params.summary }}`.
+- A pipeline whose terminal stage is `.RenderString` and
+  whose head is `.Params.summary`:
+  `{{ .Params.summary | .RenderString }}` or
+  `{{ .Params.summary | strings.TrimSpace | .RenderString }}`.
+
+Forbidden forms:
+
+- `{{ with .Params.summary }}` and `{{ else with .Params.summary }}` —
+  these rebind `.` to the summary string and the body
+  typically emits the value raw.
+- The bare `{{ .Params.summary }}` action.
+- Variable assignment `{{ $s := .Params.summary }}` —
+  the bound name escapes the per-action scan. Authors
+  who want a local variable should inline the call
+  twice instead.
+- `.Params.summary` nested inside a non-`.RenderString`
+  call (`{{ .RenderString (printf "%s" .Params.summary) }}`)
+  or piped into a function other than `.RenderString`
+  (`{{ .Params.summary | print .X }}`).
+
+`website/layouts/_default/baseof.html` is exempt by
+relative path. Its meta-description fallback emits the
+summary as plain text: the `<meta>` content attribute
+cannot carry HTML. The template renders the field
+through `$.RenderString` then `| plainify`. Backticks
+become `<code>` HTML and then plain text. SEO snippets
+see clean prose, not literal Markdown punctuation.
 
 [tpl-test]: ../../internal/release/template_summary_test.go