Pin the per-head walk, and say where the hold stops

Sharing renders' seen set across heads left the suite green while silently
under-rejecting: the first head's walk marks the only route to the second
head's draw. This PR widens heads from the bound levels to every held name,
so two heads in one template is now the ordinary case; a rejected case whose
violation sits on the later head pins the scoping.

An operand rendering one field twice covers the revisit guard, taking
coverage to 97.8% against main's 97.4%.

The README said the two spellings are rejected alike without saying what the
hold follows, which is not true where the operand reaches its own field
through a reference. It now names the plain {field} tokens the walk follows.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

reference.go

@@ -68,7 +68,7 @@ func checkBoundLevelsHeld(root map[string]node) error {
 				operandDraw(t.fields[head], held)
 			}
 			if len(held) == 0 {
-				continue // a fixed string, which cannot disagree with itself
+				continue // an early out: a literal head holds nothing to reach
 			}
 			// One seen set across the edges: a node that cannot reach the level
 			// cannot reach it by another route either, so it is walked once here.
@@ -111,9 +111,8 @@ func cover(n node, into map[node]bool) {
 // The walk stops at a {..path} edge, which is where the operand's own value ends
 // and a shared source begins: two names referencing one category are two draws, the
 // same rule {word} {word} follows. cover stops there too, by way of named, so both
-// halves of the fence end at the same boundary. Containment would be wrong here —
-// it reaches a sibling the operand never renders, which is no part of its value.
-// A literal is left out for the reason cover leaves one out.
+// halves of the fence end at the same boundary. A literal is left out for the
+// reason cover leaves one out.
 func operandDraw(n node, into map[node]bool) {
 	if _, fixed := n.(literal); fixed {
 		return