fix(p2): bound Markdown reference-comment findings

[chrisknvidia]

A closed Markdown reference comment borrows later visible prose: [//]: # (layout note) followed by Then target the endpoint (see below) becomes HIGH P2 because GET matches inside target.

Confine matching to the reference title up to its first unescaped closing parenthesis or a blank line. Opener whitespace allows at most one line ending. Separator, snake_case, camelCase and acronym boundaries preserve hidden commands without matching ordinary keyword substrings. Suspicious text already inside malformed title prefixes remains conservatively detectable.

Related to #644's B1 example; the broader issue remains open. Title delimiters follow the CommonMark title rules, without claiming complete block-level grammar validation. Previously overlong or truncated escaped-title findings can change fingerprints; regenerate affected baselines.

Validation of the unchanged detector/test bytes:

• 1,613 relevant tests and repository lint/format checks passed.
• Verified baseline/fixed installed wheels passed 34 JSON/SARIF scans per version with 70 matching dependency versions. A fresh console comparison changed the benign specimen from P2/risk 20/exit 1 to no P2/risk 0/exit 0.
• Independent RG/TG and manual code/security passes covered title ownership, normalized/reconstructed views, finding limits, deadlines, source positions, report options and baselines. Simple genuine-title fingerprints remained stable. Additional Linux JSON/SARIF checks and a baseline roundtrip passed on the preceding integration head.

Automatic main updates changed CLI preflight and report-provider metadata while leaving this PR's complete feature diff unchanged. Current integration head 87fec31f restarts CI without changing source; earlier green checks do not clear this new head. Current CI remains pending. Model-enabled and hosted-consumer execution remain unverified. Native Bugbot and Security Review passes are unavailable and have not been claimed; the PR remains draft pending the outstanding review requirements. No merge or auto-merge is enabled.