fix: harden docs checker heading lines, definitions and docs symlinks

- N1: never call Lines() on inline nodes; locate empty ATX headings after the
  end of all preceding blocks (no panic, correct line after `***`)
- N2: take reference definition lines from ast.LinkReferenceDefinition and
  drop refCtx/defRe
- N3: reject docs/adr and docs/plans that resolve outside the repository

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/docs/links_test.go

@@ -73,6 +73,8 @@ func TestLinkForms(t *testing.T) {
 		{"duplicate definition is checked", "[a]: /docs/spec.txt\n\n[a]: ../bad.md", []string{":37: relative"}},
 		{"definition in a blockquote", "> [Zed]: ../bad.md", []string{":35: relative"}},
 		{"definition-like line in code", "```\n[a]: x\n```\n\n[a]: ../bad.md", []string{":39: relative"}},
+		{"definition-like paragraph continuation", "Some text\n[a]: ../x.md\n\n[a]: ../bad.md", []string{":36: relative", ":38: relative"}}, // [a] in the text is a reference link
+		{"definition-like line in an HTML comment", "<!--\n[a]: x\n-->\n\n[a]: ../bad.md", []string{":39: relative"}},
 		{"autolink on a later line", "Para one\nline two\n<ftp://example.com/x>", []string{":37: scheme"}},
 		{"image without alt on a later line", "Para one\nline two\n![](foo.md)", []string{":37: relative"}},
 		{"unused definition", "[r]: foo.md", []string{":35: relative"}},