FETCH_HEAD is a file that could theoretically be overwritten between
steps if another fetch runs. Using the hash saved to step outputs is
safer and more explicit.

checkEmdash already tracks inFence state to skip code blocks.
checkForbiddenPatterns was missing the same logic, causing false
positives on URLs inside Candid/code block comments.

…nline

Consistent with ic.did / http-gateway.did: copy internet_identity.did to
public/references/internet-identity.did and replace the <CodeBlock> inline
with a prose download link. Reduces internet-identity-spec.md from 2075
to 736 lines. Workflow updated to stage the .did file.

Site uses remarkPlantUML; Mermaid blocks render as raw text. The sync
script now converts sequenceDiagram blocks to PlantUML automatically.
Conversion rules: participant alias/name flipped and quoted, <br>
becomes \n, sequenceDiagram keyword stripped, wrapped in @startuml/@enduml.
Adds a validation check that exits non-zero if any mermaid blocks remain
after conversion (catches unsupported diagram types added upstream).

…rand skin

The plugin only injects the SKIN when content does not already start with
@startuml. Other diagrams in the docs omit the wrapper and let the plugin
add it. Converted diagrams now follow the same pattern.

…dentials-spec.md

Extends the sync script to also produce a normative reference page from
.sources/internetidentity/docs/vc-spec.md. Rewrites 5 stale portal links
at sync time; upstream fix tracked in dfinity/internet-identity#3889.

The ii-spec link to vc-spec.md now resolves to the reference page instead
of the implementation guide. The guide's "Next steps" section updated
to link to the new reference page rather than the raw GitHub file.

- Submodule table: add docs/vc-spec.md as a synced source
- Extra checks row: document vcLinkMap, clarify the "only bump if synced
  docs changed" policy, and note the workflow skips unrelated code bumps
- Link adaptation section: cover verifiable-credentials-spec.md and note
  that the vc-spec rewrites become harmless once dfinity/internet-identity#3889 is resolved
- Workflow: add docs/vc-spec.md to the changed-files filter, stage
  verifiable-credentials-spec.md in the commit step, and update PR body

…patch