…H-79)

Adds 2 input-shape variants of the chain-walker panic at
`src/subtokenize.rs:149` ("expected link") that this PR already covers
with `[](a (a \n))`. Both new shapes hit the same `expect` on an
event whose `link` field is `None`, but reach it via different
construct paths:

* `[x](/x "> \n")` — inline link with quoted title containing a bare
  `>` followed by a newline. 13 bytes, hand-reduced from a 39-byte
  fuzzed input.
* `[][a \n]\n\n[a ]:\0` — collapsed-reference link `[][...]` whose
  label contains a space-newline pair, with a definition whose URL is
  a NUL byte. 15 bytes.

Both panic at the same site in 1.0.0 release. The single chain-builder
integrity fix that closes this PR's case (`[](a (a \n))`) is likely to
close all three together: in each case `attention.rs` produces an
event with `link: None` (lines 364–413) that gets spliced into the
`label_end.rs` link-content chain consumed by `subtokenize::call`.

Verified to fail against `markdown = "=1.0.0"` in release. Use the
weaker `matches!(_, Ok(_))` assertion since the spec-correct HTML
output for these inputs is not load-bearing for what this test
demonstrates — only that the call returns rather than panics.

Found via in-tree fuzzing campaign.

Related-to: wooormGH-79.