Fix spurious mentions from literal action-text-attachment tags in CLI content

[robzolkos]

Summary

• An LLM using the CLI created a card with markdown content that included a backtick-wrapped <action-text-attachment> tag (as documentation about how attachments work). Since the CLI sent content as-is, Action Text parsed the literal tag as a real attachment, creating spurious mentions and causing Mention::CreateJob errors.
• The fix runs card descriptions and comment bodies through goldmark (markdown-to-HTML) before sending, converting backtick-wrapped HTML tags into escaped <code> blocks while passing through raw HTML unchanged so real attachments continue to work.
• Also fixes parseAttachments to handle <figure> blocks that appear outside the </action-text-attachment> closing tag (caused by goldmark wrapping bare attachment tags in <p>), which was a pre-existing test failure.
• Plain text content without any HTML or markdown syntax passes through unchanged.

Changes

• internal/commands/markdown.go — New markdownToHTML() function with goldmark conversion and post-processing for backtick-wrapped attachment tags in HTML blocks
• internal/commands/card.go — Card create/update descriptions run through markdownToHTML()
• internal/commands/comment.go — Comment create/update bodies run through markdownToHTML()
• internal/commands/attachment.go — Updated parseAttachments regex to capture trailing <figure> blocks
• internal/commands/markdown_test.go — 8 unit tests covering all conversion scenarios
• internal/commands/attachment_test.go — Unit test for figure-outside-attachment parsing
• e2e/tests/markdown_sanitization_test.go — 5 e2e tests: backtick escaping (card + comment), real attachments still work (card + comment), and mixed real + backtick in same description