Treat marker-less HTML starting with a doctype or <html> as a document - #11877

When a frame receives HTML with no flush marker, the flush kind is now inferred from the markup instead of defaulting to fragment. HTML that starts with a doctype or <html> is treated as a whole document.

Why

renderToString strips flush markers before returning, so its output carries no <!-- rmx:flush document --> marker. createFrame only takes the full-document-reload path when flushKind === 'document', and renderFrameStream applied its end-of-stream remainder as a fragment. Marker-less document HTML therefore went through createFragmentFromString, which parses inside a <template> and drops the <html>/<head>/<body> wrappers. diffNodes then tried to insert those nodes beside documentElement and Chromium threw:

HierarchyRequestError: Failed to execute 'insertBefore' on 'Node': Only one element on document allowed.

The Navigation API keeps the committed URL and fires navigateerror, so a click looked like a no-op: the URL changed, the document did not, and nothing appeared in the console.

Inferring the kind also covers static output that lost its comments to a minifier, and restores the document sniffing finalizeHtml did before #11353.

Reproduction

https://github.com/devtechedge/remix-render-to-string-navigation

A minimal app with a client entry on page A and two destination pages, one rendered with renderToStream and one with renderToString. npm run verify clicks both links in Chromium and prints the URL, title, and heading before and after each click. Before this change only the renderToStream link navigates; after it both do.

Tests

Three regressions in packages/ui/src/test/frame.test.ts cover the stream path, the string path, and real renderToString output. All three fail on main with the HierarchyRequestError above and pass with this change.

The full packages/ui suite is green: 1081 tests, 1056 pass, 0 fail, 24 todo.

Fixes #11808