fix: correct reference safety, CLI parsing, and report behavior

[rogerdigital]

Summary

Fix the ten audited correctness issues across reference indexing, link fixes, CLI parsing, and report interactions. Fragment references now protect referenced files, automatic link removal preserves code and escaped examples, and heading/block checks use the correct target metadata.

• Correct CLI encoded and parenthesized Markdown destinations, explicit --fail-on precedence, and YAML frontmatter semantics; preserve balanced external URL parentheses.
• Align the new-findings summary with its review filter and preserve comma-containing duplicate paths in rendering and exports.
• Advance comparison semantics to version 3 without changing JSON schema version 1; restart incompatible plugin comparisons and reject incompatible CLI baselines.
• Include integration fixes for missing Web Crypto on Node 18 and the first frontmatter closing delimiter. Keep scanner changes in separate commits and document execution evidence in docs/superpowers/plans/2026-09-08-audit-bugfix-plan.md.

Validation

• npm run lint, npm run lint:obsidian-warnings, npm run build, npm test, and npm pack --dry-run pass: 914 tests across 60 files.
• Coverage passes unchanged thresholds: 84.36% lines, 79.60% branches.
• Packed and installed CLI passes seven scenario checks on actual Node 18.20.8 and Node 24.16.0.
• Obsidian 1.13.7 checks cover comparison restart, PDF/block/heading references, source-preserving link removal, mixed new findings, comma-path opening, duplicate keep selection, and readable resolved badges in light/dark narrow sidebars. Original test-vault preferences were restored and fixtures cleaned up.
• 400-note benchmark retains all 246 findings; median load 117ms versus 56ms baseline, scan 54ms versus 75ms. Parser dependencies are bundled; the plugin's only external import remains obsidian.

Remaining verification boundaries

The immediate scan after a source fix once read stale native metadata; a later manual scan correctly showed resolution, and disk content was correct. Native normalization of unresolved .md destinations can still conservatively withhold an automatic fix action. Desktop export and manual preflight-race/batch-exclusion walkthroughs were not completed; persistent integration tests cover those paths. These observations are recorded in the plan and are not claimed resolved by this PR.