fix: close two Pass 10 guard gaps and a stale trunk_branch doc claim

[joshua-temple]

Three disjoint Pass 10 findings, each in a different file, fixed with mutation/execution proof.

1. gitignore guard missed the root scenario tier (test hardening)

TestScenarios_AreNotGitIgnored globbed scenarios/*/*.y*ml, covering the 44 subdirectory scenarios and none of the ~72 root-tier ones. A root-tier scenario swallowed by a .gitignore rule (the cascade-* class this guard shipped to close) stayed invisible.

• Mutation: an ignored probe in scenarios/hotfix/ reds the guard, but an identical ignored probe at scenarios/99-probe.yaml passed it. After switching to a recursive walk, both tiers red.

2. docs-example guard blind to annotated fences (test hardening)

extractYAMLFences matched only the exact yaml/yml info string, so a Starlight fence yaml title="cascade.yaml" escaped TestSchema_ValidatesDocsExamples.

• Mutation: an invalid ci: block behind a bare ```yaml fence reds; behind ```yaml title="x" it passed. Now matches yaml/yml as a whole leading token followed by end-of-string or whitespace, and does not over-match yamlfoo or yaml-lint.

3. stale trunk_branch default claim (docs)

reference/generated-workflows.md stated the push trigger reads config.trunk_branch "(default main)". False since trunk_branch became required.

• Execution: cascade lint on a manifest omitting trunk_branch emits [ERROR] trunk_branch is required; generate-workflow with trunk_branch: release writes branches: [release]. Corrected the claim to required, no default. A full docs grep found this as the only stale prose instance.

Verification

• Root: go build, go test (3453 pass), golangci-lint clean.
• e2e: build + vet clean; scenario-integrity and discovery tests pass.
• cascade verify --own-repo: no drift. Changelog guard passes.

Not fleet-relevant: test guards plus a docs correction, no generator or release-path behavior change.