fix(lint): resolve TOML blocking errors; add elide-marker normalizer rule (#7166)

Validator improvement:
  scripts/lib/codeblock-normalizer.mjs — add a third normalization
  rule that comments out standalone elide markers (..., ...., [...])
  before parsing. These markers are pervasive in Telegraf and
  InfluxDB TOML examples and YAML config snippets to indicate
  omitted content, but neither parses as valid TOML/YAML. The new
  rule rewrites them as language-appropriate comments (# ... for
  TOML/YAML/bash/python, // ... for JS) so blocks with otherwise
  valid syntax pass without forcing authors to manually comment
  every ellipsis. JSON has no comment syntax, so JSON fences with
  ellipses must still be fixed at the source. For YAML, the
  substitution skips column-0 ... (the YAML stream document-end
  marker) — only indented occurrences are treated as ellipsis. This
  alone clears 22 of the 49 originally-flagged TOML errors.

Content fixes (toml fence preserved):
  - cloud-dedicated / cloud-serverless / clustered v1 API guides:
    Replace curly close-quote (U+201D) in `content_encoding = "gzip”`
    with the straight ASCII `"` so the string terminates correctly.
  - kapacitor reference/event_handlers/post.md (5 errors):
    Strings containing literal `{{index . "time"}}` template
    expressions had inconsistent quoting — outer "..." with
    unescaped inner ". Switched to TOML literal strings (single-
    quoted) for url and row-template values; inner double quotes
    are now safe and verbatim.
  - kapacitor administration/subscription-management.md (2 errors):
    `db_name = <list of retention policies>` had literal angle
    brackets, invalid TOML. Changed to a commented pattern.
  - kapacitor reference/event_handlers/zenoss.md:
    Bare inline table `{ ... }` lacked a key. Added `severity-map = `.
  - kapacitor reference/nodes/alert_node.md:
    Bare `timeout = 10s` is not valid TOML (TOML has no duration
    primitive). Quoted as "10s" — matches the convention used by
    39 other duration values across Kapacitor docs. Kapacitor's
    config parser still decodes the string into its Duration type.
  - kapacitor administration/configuration.md:
    Two alternative configs (v1 / v2-or-Cloud) shared the same
    [[influxdb]] section, producing duplicate `enabled` and
    `default` keys. Split into two separate ```toml fences with
    intervening prose. Each block now parses on its own.
  - kapacitor administration/auth/kapacitor-auth.md:
    `auth-enabled: true` used YAML colon syntax inside a TOML block.
    Changed to `auth-enabled = true`.
  - kapacitor guides/event-handler-setup.md:
    `parse-mode = Markdown` had a bare value; quoted as "Markdown".
  - influxdb v1 administration/https_setup.md:
    Lone `>` and bracketed `[...]` markers inside a TOML block were
    blockquote/elide leakage from rendering. Replaced with
    descriptive TOML comments.
  - enterprise_influxdb v1 administration/configure/config-data-nodes.md:
    Mangled prose-mixed-with-TOML around the [[collectd]] section
    (`Default is `false.`, stray backticks). Cleaned up to a
    standard commented-defaults block.
  - enterprise_influxdb v1 administration/configure/security/ldap.md:
    A 12-line comment block was duplicated verbatim, each followed
    by the same client-tls-certificate / client-tls-private-key
    assignments — producing duplicate-key errors. Removed the second
    (byte-identical) block; the original block above documents the
    keys.
  - enterprise_influxdb v1 tools/influxd-ctl/ldap/sample-config.md:
    Shell prompt `meta1:/# influxd-ctl ldap sample-config -h` was
    embedded mid-TOML. Moved to a TOML comment showing the producing
    command.
  - telegraf v1 configuration.md:
    Block demonstrates Telegraf's preprocessor `${VAR}` substitution,
    which uses bare unquoted form for non-string values
    (`skip_database_creation = ${VAR}`). That syntax is a Telegraf
    extension to TOML and not parseable by strict TOML validators.
    Relabeled the fence as `text` with an HTML comment explaining why.
  - telegraf v1 data_formats/input/json_v2.md:
    Inline parenthetical `false (or true, just not both)` was not a
    valid TOML comment. Changed to a proper trailing `#` comment.

Deferred to upstream telegraf README sync (6 errors):
  - input-plugins/jti_openconfig_telemetry, opcua_listener,
    postgresql_extensible, win_eventlog
  - output-plugins/dynatrace
  - processor-plugins/converter
  These docs are generated from influxdata/telegraf README files
  per content/telegraf/CLAUDE.md. Any fix here would be reverted on
  the next sync; they need to be filed and fixed upstream first.

Test coverage: 59/59 lint-codeblocks tests still pass.

Author: jstirnaman

content/enterprise_influxdb/v1/administration/configure/config-data-nodes.md

@@ -1499,9 +1499,7 @@ For more information, see [CollectD protocol support in InfluxDB](/enterprise_in
 ### [[collectd]]
 
 ```toml
-# enabled`
-
-Default is `false.
+# enabled = false  # default
 # bind-address = ":25826"
 # database = "collectd"
 # retention-policy = ""

content/enterprise_influxdb/v1/administration/configure/security/ldap.md

@@ -187,21 +187,6 @@ enabled = true
   client-tls-certificate = "/var/run/secrets/ldapClient.pem"
   client-tls-private-key = "/var/run/secrets/ldapClient.key"
 
-  # Client certificates to present to the LDAP server are supported with
-  # "client-tls-certificate" and  "client-tls-private-key" configurations.
-  # These are paths to the X.509 client certificate and corresponding private
-  # key, respectively. If "client-tls-certificate" is set but 
-  # "client-tls-private-key" is not, then "client-tls-certificate" is assumed
-  # to bundle both the certificate and private key.
-  # The LDAP server may request and require valid client certificates
-  # even when InfluxDB is configured with an insecure TLS mode that ignores
-  # LDAP server certificate errors.
-  # Not all LDAP servers will request a client certificate. It is not
-  # necessary to set "client-tls-certificate" and "client-tls-private-key"
-  # if the LDAP server does not require client certificates.
-  client-tls-certificate = "/var/run/secrets/ldapClient.pem"
-  client-tls-private-key = "/var/run/secrets/ldapClient.key"
-
   # Credentials to use when searching for a user or group.
   bind-dn = "cn=read-only-admin,dc=example,dc=com"
   bind-password = "read-only-admin's password"

content/enterprise_influxdb/v1/tools/influxd-ctl/ldap/sample-config.md

@@ -80,7 +80,8 @@ enabled = true
   [[servers.group-mappings]]
     group = "web-support"
     role = "web-traffic-ro"
-meta1:/# influxd-ctl ldap sample-config -h
+
+# Output from: meta1:/# influxd-ctl ldap sample-config -h
 # Sample TOML for ldap config.
 # First, save this file and edit it for your LDAP server.
 # Then test the config with: influxd-ctl ldap verify -ldap-config /path/to/ldap.toml

content/influxdb/v1/administration/https_setup.md

@@ -225,19 +225,19 @@ setting and set it to `true`.
     ###############################################################################
     #                            OUTPUT PLUGINS                                   #
     ###############################################################################
->
+
     # Configuration for InfluxDB server to send metrics to
     [[outputs.influxdb]]
       ## The full HTTP or UDP endpoint URL for your InfluxDB instance.
       ## Multiple urls can be specified as part of the same cluster,
       ## this means that only ONE of the urls will be written to each interval.
       # urls = ["udp://localhost:8089"] # UDP endpoint example
       urls = ["https://<domain_name>.com:8086"]
->
-    [...]
->
+
+      # ... other output options elided ...
+
       ## Optional SSL Config
-      [...]
+      # ... other SSL options elided ...
       insecure_skip_verify = true # <-- Update only if you're using a self-signed certificate
 ```
 

content/influxdb3/cloud-dedicated/guides/api-compatibility/v1/_index.md

@@ -329,7 +329,7 @@ To configure the v1.x output plugin for writing to {{% product-name %}}, add the
   retention_policy = ""
   username = "ignored"
   password = "DATABASE_TOKEN"
-  content_encoding = "gzip”
+  content_encoding = "gzip"
 ```
 {{% /code-placeholders %}}
 

content/influxdb3/cloud-serverless/write-data/api/v1-http.md

@@ -148,7 +148,7 @@ To configure the v1.x output plugin for writing to {{% product-name %}}, add the
   retention_policy = "RETENTION_POLICY"
   username = "ignored"
   password = "API_TOKEN"
-  content_encoding = "gzip”
+  content_encoding = "gzip"
 ```
 {{% /code-placeholders %}}
 

content/influxdb3/clustered/guides/api-compatibility/v1/_index.md

@@ -315,7 +315,7 @@ To configure the v1.x output plugin for writing to {{% product-name %}}, add the
   retention_policy = ""
   username = "ignored"
   password = "DATABASE_TOKEN"
-  content_encoding = "gzip”
+  content_encoding = "gzip"
 ```
 {{% /code-placeholders %}}
 

content/kapacitor/v1/administration/auth/kapacitor-auth.md

@@ -78,7 +78,7 @@ authenticate requests to the Kapacitor HTTP API.
     ```toml
     [http]
       #...
-      auth-enabled: true
+      auth-enabled = true
       #...
     ```
 

content/kapacitor/v1/administration/configuration.md

@@ -432,6 +432,8 @@ To use Kapacitor with an InfluxDB instance that requires authentication,
 the InfluxDB user must have [admin privileges](/influxdb/v1/administration/authentication_and_authorization/#admin-users).
 {{% /note %}}
 
+To connect to InfluxDB OSS 1.x or InfluxDB Enterprise, use the following configuration:
+
 {{< keep-url >}}
 ```toml
 # ...
@@ -440,27 +442,28 @@ the InfluxDB user must have [admin privileges](/influxdb/v1/administration/authe
   # Connect to InfluxDB
   # Kapacitor can subscribe, query, and write to this cluster.
   # Using InfluxDB is not required and can be disabled.
-  # To connect to InfluxDB OSS 1.x or InfluxDB Enterprise, 
-  # use the following configuration:
-  
+
   enabled = true
   default = true
   name = "localhost"
   urls = ["http://localhost:8086"]
   username = ""
   password = ""
   timeout = 0
+```
 
-  # To connect to InfluxDB OSS 2.x or InfluxDB Cloud, 
-  # use the following configuration:
-  
+To connect to InfluxDB OSS 2.x or InfluxDB Cloud, use the following configuration instead:
+
+{{< keep-url >}}
+```toml
+[[influxdb]]
   enabled = true
   default = true
   name = "localhost"
   urls = ["http://localhost:8086"]
   token = ""
-  timeout = 0 
-  
+  timeout = 0
+
   # By default, all data sent to InfluxDB is compressed in gzip format.
   # To turn off gzip compression, add the following config setting:
   compression = "none"

content/kapacitor/v1/administration/subscription-management.md

@@ -107,7 +107,7 @@ If empty, Kapacitor will subscribe to all databases and retention policies excep
 ```toml
 [influxdb.subscriptions]
   # Pattern:
-  db_name = <list of retention policies>
+  # db_name = [<list of retention policies>]
 
   # Example:
   my_database = [ "default", "longterm" ]
@@ -119,7 +119,7 @@ Defines a set of databases and retention policies to exclude from subscriptions.
 ```toml
 [influxdb.excluded-subscriptions]
   # Pattern:
-  db_name = <list of retention policies>
+  # db_name = [<list of retention policies>]
 
   # Example:
   my_database = [ "default", "longterm" ]