add khosra check, the place content errors are looked for

The server never fails on a bad bundle — it works around it and logs, which is easy
to miss (ADR-0029). This is the command that looks on purpose, and it exits non-zero
on anything that makes the site wrong rather than merely untidy.

Fatal: content the engine had to drop (unparseable frontmatter, a key two files
claim, an ignored slug or alias) and links that will 404 for a reader. Warnings:
no title, a figure with no alt text, a series where some members declare order and
others do not — that last one because unordered members sort last, so adding order
to one chapter silently moves every chapter that lacks it.

Two things this needed rather than invented. `Scan` and `Site` now *return* what they
worked around instead of only logging it: `ScanReport` and `Site.Problems`, with
`Scan` staying the logging wrapper so nothing else changed. And required-fields-per-type
is deliberately absent — `title` is the only field the engine requires today, so
checking more would mean inventing the type declaration that is still parked. Its
trigger stays where it was.

The link checker asks the same questions the resolver asks — bundle, alias, section
listing, file inside a bundle — because a checker that guesses differently from the
server is worse than no checker. Engine-owned paths are skipped: they are generated,
not authored.

It lives in internal/ext/check, so cmd/ stays wiring and the feature stays deletable.
Verified against the evidence site: clean before, and five findings across five fault
classes after I introduced them on purpose.

internal/content/content.go

@@ -72,12 +72,33 @@ func OpenSite(dir string) (fs.FS, error) {
 	return root.FS(), nil
 }
 
-// Scan reads every bundle under content/ in fsys.
+// Problem is something wrong with the content that the engine worked around.
+//
+// Every one of these is also a log line when the server starts, but `check` needs them as data rather than as
+// text, so they are collected here and reported by whoever asked (ADR-0029).
+type Problem struct {
+	// Path names the file, or the key when the trouble is about identity rather than one file.
+	Path string
+	// Detail says what was wrong, in the terms an author can act on.
+	Detail string
+}
+
+// Scan reads every bundle under content/ in fsys, logging anything it worked around.
 //
 // A bundle that cannot be parsed, or that collides with another on the same key and language, is logged
 // at error level and left out; neither is fatal, because one mistyped colon must not take down a site
 // (ADR-0029). An error is returned only when the walk itself fails.
 func Scan(fsys fs.FS) ([]Bundle, error) {
+	found, problems, err := ScanReport(fsys)
+	for _, p := range problems {
+		slog.Error("content problem", "path", p.Path, "detail", p.Detail)
+	}
+	return found, err
+}
+
+// ScanReport is Scan with the problems returned instead of only logged.
+func ScanReport(fsys fs.FS) ([]Bundle, []Problem, error) {
+	var problems []Problem
 	var found []Bundle
 	err := fs.WalkDir(fsys, "content", func(p string, d fs.DirEntry, err error) error {
 		switch {
@@ -95,12 +116,12 @@ func Scan(fsys fs.FS) ([]Bundle, error) {
 		}
 		data, err := fs.ReadFile(fsys, p)
 		if err != nil {
-			slog.Error("skipping unreadable bundle", "path", p, "err", err)
+			problems = append(problems, Problem{p, "unreadable, so it is not served: " + err.Error()})
 			return nil
 		}
 		b, err := Parse(strings.TrimPrefix(p, "content/"), data)
 		if err != nil {
-			slog.Error("skipping unparseable bundle", "path", p, "err", err)
+			problems = append(problems, Problem{p, "not served, cannot be parsed: " + err.Error()})
 			return nil
 		}
 		b.Path = p
@@ -108,9 +129,10 @@ func Scan(fsys fs.FS) ([]Bundle, error) {
 		return nil
 	})
 	if err != nil {
-		return nil, fmt.Errorf("scan content: %w", err)
+		return nil, problems, fmt.Errorf("scan content: %w", err)
 	}
-	return dropCollisions(found), nil
+	kept, collisions := dropCollisions(found)
+	return kept, append(problems, collisions...), nil
 }
 
 // Parse reads one bundle from the bytes of a file, named relative to content/.
@@ -339,21 +361,22 @@ func trimLeadingFence(data []byte, fence string) ([]byte, bool) {
 //
 // Two spellings of the same variant — about.md and about.en.md, or about.md and about/index.md — are
 // ambiguous rather than harmless, so none of them is served (ADR-0021).
-func dropCollisions(all []Bundle) []Bundle {
+func dropCollisions(all []Bundle) ([]Bundle, []Problem) {
 	seen := map[string]int{}
 	for _, b := range all {
 		seen[b.Key+"\x00"+b.Lang]++
 	}
+	var problems []Problem
 	kept := make([]Bundle, 0, len(all))
 	for _, b := range all {
 		if seen[b.Key+"\x00"+b.Lang] > 1 {
-			slog.Error("skipping ambiguous bundle: two files claim one key and language",
-				"key", b.Key, "lang", b.Lang, "path", b.Path)
+			problems = append(problems, Problem{b.Path,
+				"not served: another file claims the same key (" + b.Key + ") and language (" + b.Lang + ")"})
 			continue
 		}
 		kept = append(kept, b)
 	}
-	return kept
+	return kept, problems
 }
 
 // PerPage is how many entries a listing shows.