Keep exported page content Markdown-inert

[Driedsandwich]

Summary

• place visible Issue and Pull Request body/comment previews in dynamically sized fenced code blocks nested inside the existing untrusted-content blockquotes
• keep image syntax, links, raw HTML, headings, and variable-length backtick runs inert in downstream Markdown renderers
• keep ordinary, multiline, and empty preview content readable with no dependency or permission expansion
• align the public preview documentation and manual verification checklist

Scope

This PR addresses only GPTPro re-audit finding F005. F003, F004, F006, and unrelated behavior are intentionally excluded.

Closes #10

Verification

• npm test — 40/40 passed
• repository sanity workflow commands — passed locally
• local marked renderer proof — page-supplied image/link/raw-HTML/heading syntax remained inactive
• official Gitleaks 8.30.1 exact tree — finding 0
• official Gitleaks 8.30.1 introduced range bc58d625..b1ffedbf6bbadcf156260c9e71e7d815e472f4d5 — finding 0
• Codex Security diff scan dfc65bac-063e-43bb-a85f-e107b683afe6 — finding 0, coverage complete
• exact-head Chrome for Testing 151 Load unpacked receipt — Issue, PR Conversation, unsupported page, Copy, Download, nested-fence shape, and permissions all passed
• manifest permissions remain exactly activeTab, scripting, and clipboardWrite; no host permissions

Boundaries

• visible-page-only and human-review-before-sharing behavior remain unchanged
• no GitHub API, external transmission, external LLM, dependency, host permission, or Chrome Web Store change
• Draft and unmerged pending maintainer review