The src and diagnostics fields are only constructed inside the
crate (registration.rs, pipeline.rs, error.rs tests). Making them
pub(crate) enforces the invariant that diagnostics always pair with
the right NamedSource.

Assisted-by: GLM-5.1 via pi

diff --git a/src/ci/pipeline.rs b/src/ci/pipeline.rs
index 9943f11..b715f7a 100644
--- a/src/ci/pipeline.rs
+++ b/src/ci/pipeline.rs
@@ -330,10 +330,10 @@ pub struct PipelineError {
     // Named `src` rather than `source` so thiserror doesn't auto-treat
     // it as the error chain.
     #[source_code]
-    pub src: NamedSource<String>,
+    pub(crate) src: NamedSource<String>,
 
     #[related]
-    pub diagnostics: Vec<Diagnostic>,
+    pub(crate) diagnostics: Vec<Diagnostic>,
 }
 
 /// Compile a ci.fnl source string into a validated [`Pipeline`].