fix(markdown): pin JavaScript buffer inputs during rendering

Bun parity gap confirmed by js/bun/md/md-render-callback.test.ts.

Home currently copies buffer input for callback rendering. That avoids a dangling native slice, but it changes the observable contract: a callback can detach the caller buffer while rendering is still in flight. Bun live Rust instead pins the backing ArrayBuffer, re-derives the post-materialization view, and unpins on every synchronous exit path. The same pin is required around html, ansi, render, and react because option getters or renderer callbacks can execute JavaScript after the input slice is obtained.

Scope:

• add an RAII-style PinnedView helper around StringOrBuffer buffer variants
• use the post-pin ArrayBuffer slice in all four Markdown entrypoints
• remove the copy-based callback workaround
• verify that transfer is blocked during callbacks and succeeds after return

Parent: #66

Implemented pin/re-derive/unpin ownership for JavaScript-backed Markdown inputs in 641a563. All four entry points now read the ArrayBuffer returned by pinning, which is required because JSC may materialize and repoint fast typed-array storage. Zig AST and whitespace checks pass. Fresh native acceptance remains pending under the fixed 3,840 MB build ceiling.