fix(reliability): bound hyperlink target metadata before URI parsing

[seonghobae]

Duplicate resolution

Fresh single-writer inspection found that existing Draft PR #176 / branch fix/public-markdown-resource-options-175 is already the sole active writer for src/policy/safeLinkPolicy.ts and the SafeLink resource-policy boundary.

Its unchanged exact head 1359aaa381a02627828ff950584ff46ff7691062 already implements the material acceptance criteria this issue proposed:

• default 65,536-byte hyperlink ceiling with a bounded configurable hard maximum;
• UTF-16 lower-bound rejection before full UTF-8 materialization;
• exact UTF-8 byte enforcement before URI parsing;
• public SafeLinkHrefError categories for oversized input and invalid configuration;
• <oversized> payload-redacted diagnostics;
• a regression that instruments the platform URL constructor and proves an oversized HTTPS target is rejected before URL construction; and
• fail-closed runtime option-shape/accessor validation.

Creating a new branch would violate Inkspan's single-writer rule and duplicate active implementation. Protected main@e8109ec2a17de8bd6594487aa12c8c8a93cb2c03 does not yet contain this next-release behavior; #176 remains Draft/unmerged while #118 owns the exact v0.6.0 publication boundary.

Closed as duplicate of the SafeLink resource-policy work already carried by #176. No source branch or competing writer was created for this issue.