Bind the correct config-source file to Q-5-8/Q-5-1 diagnostic spans (bd-m6wmztln, bd-p86nlm92)

[cscheid]

Problem

A pre-render script (or project.resources pattern) contributed by an extension via contributes.metadata.project carries a SourceInfo anchored in the extension's _extension.yml, using quarto-yaml's filename-hash FileId. The Q-5-8 / Q-5-1 diagnostic assembly bound _quarto.yml's content to that FileId unconditionally, rendering the extension file's byte offsets against the wrong text:

• Misleading span when the offsets fit inside _quarto.yml — observed live in the q2-connect-docs testbed, where a failing quarto-openapi pre-render script pointed at the unrelated post-render: block of _quarto.yml.
• Silently dropped snippet when the offsets exceed the file.

Fix

Follows the candidate-matching precedent already used by theme_diagnostic::sass_error_to_parse_error:

• New quarto_core::config_sources::bind_config_source: re-derives each candidate file's FileId with quarto_yaml::file_id_for_filename, registers only the matching file (and only with readable content), and returns the matched path for prose attribution. No match ⇒ nothing registered, span-less degradation — never a wrong span.
• ProjectConfig.extension_manifest_paths records every discovered extension's manifest path at config-parse time (reconstructed as ext.path.join("_extension.yml"); bd-xh1v98d9 tracks storing the real path on Extension).
• RenderScriptsContext threads the candidates through its five construction sites (render ×2, publish ×2, quarto-preview boot).
• script_error and the new resource_error_to_config_parse_error bind via the helper and add an ℹ info line naming the contributing extension manifest when the entry is not from _quarto.yml. The doc-level resource_error_to_parse_error keeps its contract, now documented as doc-provenance-only (layered-metadata caveat tracked in bd-nv4p0eb1, the systematic span/FileId audit).

After

Error [Q-5-8]: Pre-render script failed
    ╭─[ …/docs-quarto-2/_extensions/posit-dev/quarto-openapi/_extension.yml:9:11 ]
    │
  9 │         - _extensions/posit-dev/quarto-openapi/openapi-to-markdown.ts
    │           ──────────────────────────────┬─────────────────────────────
    │                                         ╰─ Script `…/openapi-to-markdown.ts` exited with status 1. …
────╯
ℹ This entry is contributed by the extension manifest `…/_extension.yml`
  (`contributes.metadata.project`), not by your project configuration file.

Testing

• TDD: both new integration tests were verified failing before the fix — render_scripts_cli::failing_extension_contributed_script_snippet_names_extension_yml (Q-5-8) and extension_config_spans::out_of_project_resource_contributed_by_extension_names_extension_yml (Q-5-1) — plus a strengthened _quarto.yml control assertion and five unit tests for the helper.
• Workspace: 11127 tests pass; full cargo xtask verify green (including the hub/WASM leg).
• E2E inspected against the repro fixture and the q2-connect-docs testbed; no snapshot files changed.

Plan: claude-notes/plans/2026-08-09-q58-extension-script-diagnostic-span.md
Strands: bd-m6wmztln (main), bd-p86nlm92 (resources leg, folded in). Follow-ups filed: bd-nv4p0eb1, bd-xh1v98d9, bd-2x0tmd7v.

🤖 Generated with Claude Code

[posit-snyk-bot]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.