Gate inline snippet sources in CI

[danielporterda]

Stack position

7 of 7. Depends on #1261 and completes GitHub stack #1263.

What changed

• Runs all inline snippet tests in the existing Mintlify validation workflow.
• Validates every *.source.mdx contract and rejects committed local refs with exact page/line remediation.
• Checks every opted-in page's generated MDX and release evidence against the checked-in deployed dashboard.
• Adds repository-wide snippets:check-all; it is a no-op until the first production page opts in.
• Tightens parser handling for variable-length fences, inline code examples, and trailing content after <Else>.
• Ensures generated provenance/evidence uses repository-relative paths and passes mypy.

This stack deliberately does not migrate a live page. A safe pilot needs a real upstream change and release boundary; mixing that content decision into the machinery stack would make both harder to review.

Validation

• npm run test:inline-snippets — 49 passed
• npm run test:external-snippets — 5 passed
• npm run snippets:validate — 0 opted-in pages, passed
• npm run snippets:check-all — 0 opted-in pages, passed
• ruff check scripts/snippets tests/test_inline_snippet_*.py
• mypy scripts/snippets
• cd docs-main && npx mint validate — passed
• Full suite: 264 passed, 5 skipped, 17 failed. Representative failures were reproduced unchanged on clean origin/main: x2mdx whitespace fixtures and the existing Wallet navigation expectation. The stack adds no new full-suite failure.
• Every commit is DCO-signed; git diff --check passes.

Review focus

Please focus on CI cost/credentials, fail-closed behavior when GitHub evidence is unavailable, and whether the first page migration should be a separate follow-up as proposed.