fix: harden docs checker heading lines, definitions and docs symlinks

- N1: never call Lines() on inline nodes; locate empty ATX headings after the
  end of all preceding blocks (no panic, correct line after `***`)
- N2: take reference definition lines from ast.LinkReferenceDefinition and
  drop refCtx/defRe
- N3: reject docs/adr and docs/plans that resolve outside the repository

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/docs/refs.go

@@ -108,7 +108,7 @@ func (c *checker) exists(p string) string {
 	if err != nil {
 		return "target " + p + " does not exist"
 	}
-	if rel, err := filepath.Rel(c.realRoot, real); err != nil || rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+	if !within(c.realRoot, real) {
 		return "target " + p + " resolves outside the repository"
 	}
 	if st, err := os.Stat(real); err != nil || !st.Mode().IsRegular() {
@@ -186,3 +186,9 @@ func (k kinds) String() string {
 	}
 	return strings.Join(s, ", ")
 }
+
+// within reports whether the real path p is root or lies under it.
+func within(root, p string) bool {
+	rel, err := filepath.Rel(root, p)
+	return err == nil && rel != ".." && !strings.HasPrefix(rel, ".."+string(filepath.Separator))
+}