fix: harden docs checker heading lines, definitions and docs symlinks

- N1: never call Lines() on inline nodes; locate empty ATX headings after the
  end of all preceding blocks (no panic, correct line after `***`)
- N2: take reference definition lines from ast.LinkReferenceDefinition and
  drop refCtx/defRe
- N3: reject docs/adr and docs/plans that resolve outside the repository

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/docs/check.go

@@ -62,6 +62,9 @@ func Check(root string) (Result, error) {
 		} else if err == nil && !st.IsDir() {
 			c.add(d.dir, 1, "must be a real directory (symlinks are not allowed)")
 			continue
+		} else if r, err := filepath.EvalSymlinks(filepath.Join(root, d.dir)); err == nil && !within(real, r) {
+			c.add(d.dir, 1, "must be inside the repository (a symlinked parent directory is not allowed)")
+			continue
 		}
 		entries, err := os.ReadDir(filepath.Join(root, d.dir))
 		if err != nil {