include another file from the bundle, one level deep

{{< include file="notes.md" >}} renders a file from the bundle as Markdown in
place. The included file is converted by the same goldmark instance that is
rendering the page — handed to the transformer in Extend — so its configuration
can never drift from the page's.

Three properties, each tested:

A name containing ".." is refused. os.Root would stop a path leaving the site
root, but path.Join collapses ".." long before the filesystem sees it, so without
this an include could read a template or a stray dotfile from the site root and
publish it. Verified the test fails without the guard: it took three levels of
".." from content/pages/d to reach the root, and the first version of the test
used two, so it passed either way and proved nothing.

An include inside an included file renders nothing and logs. The nested parse is
marked, so one level is all there is and a file including itself is a log line
rather than a stack overflow (ADR-0038, ADR-0029).

A gallery inside an included file still resolves, because the nested parse carries
the same Origin.

The node gained `content` for output a feature produced itself, plus `isContent`
so a failed include renders nothing instead of falling through to a fragment
lookup and complaining about a template that was never meant to exist.

internal/render/render.go

@@ -154,6 +154,12 @@ func OriginFrom(pc parser.Context) (Origin, bool) {
 	return origin, ok
 }
 
+// WithOrigin records the bundle on a parse context. A feature that starts a parse of its own — an included
+// file — carries the same Origin into it, so a path there resolves against the same bundle (ADR-0038).
+func WithOrigin(pc parser.Context, origin Origin) {
+	pc.Set(originKey, origin)
+}
+
 // New parses the theme and prepares the Markdown converter.
 //
 // siteFS may be nil, in which case only the embedded reference theme is used. A malformed template is a
@@ -260,7 +266,7 @@ func (r *Renderer) Bundle(b content.Bundle, served string, variants []string, se
 	// The parse carries which bundle it is, so a feature can resolve a path in a call against the bundle's
 	// own directory (ADR-0031: through the rooted filesystem, never a joined path).
 	pc := parser.NewContext()
-	pc.Set(originKey, Origin{Dir: path.Dir(b.Path), Files: r.files})
+	WithOrigin(pc, Origin{Dir: path.Dir(b.Path), Files: r.files})
 	var body bytes.Buffer
 	if err := r.md.Convert(b.Body, &body, parser.WithContext(pc)); err != nil {
 		return nil, fmt.Errorf("markdown %s: %w", b.Path, err)