fix: resolve Slack directives in section/mrkdwn (verbatim + non-verbatim)

[programad]

Bug

section/mrkdwn text and other mrkdwn-typed text didn't resolve Slack-formed directive atoms through their matching hooks:

• verbatim: true — the parser early-returned the raw text wrapped in a <div>, so <@U123> etc. rendered as literal text and no hooks fired.
• verbatim: false — the existing yozora directive tokenizers mostly fired today, but only because the URL-rewrite regex pass was incidentally protected by isValidURL() (directive strings aren't URLs). The protection was fragile, the regex pass corrupted directive-shaped content inside code spans, and the mrkdwn hook payload shape ({ id, name }) didn't match the rich_text path's shape ({ id, name, style }).
• Escaped entities — text_object.tsx decoded < / > / & before invoking the parser, so user-typed <@U123> (delivered as <@U123>) was decoded to a real-looking <@U123> and then resolved as a user mention, contradicting Slack's renderer which keeps escaped sequences literal.

Fix

Both verbatim: true and verbatim: false now flow through a single mask-transform-restore pipeline. Fenced code, inline code, and directive atoms are masked into placeholders before the URL-rewrite / asterisk-doubling regex pass, then restored before yozora parses. The hook payloads now match the rich_text path's shape.

Specific changes:

• The broadcast tokenizer now matches <!here> / <!everyone> / <!channel> natively (in addition to @here / @everyone / @channel).
• Yozora's autolink and autolink-extension tokenizers are unmounted. Bare URL autolinking is already handled by the existing <X> / <X|Y> regex rewrite, and autolink-extension was stealing directives like <!subteam^S1|@team> because of the embedded @.
• mrkdwn sub-element hook payloads now include style: undefined so the shape matches the rich_text path's { id, name, style }.
• <@U…|fallback> and <!subteam^S…|@team> now split on | for data lookup + fallback label (channel mention already did this).
• HTML entity decoding (< / > / &) is deferred from input pre-processing to the leaf renderers (Text, HTML, InlineCode, fenced Code, Link). User-typed text like <@U123> now survives tokenization as literal entities and decodes to plain <@U123> text at render — no false directive match.

verbatim — empirically tested in Slack

The original task spec implied verbatim: true should suppress markdown formatting, bare URL autolinking, and typed @channel-style strings, but preserve structured directives. I tested side-by-side in Slack's section/mrkdwn renderer:

Line	Verbatim TRUE	Verbatim FALSE
structured directives (<@U…>, <#C…>, <!subteam^…>, <!here>, <!date^…>)	resolved	resolved
markdown sugar (*bold*, _italic_, ~strike~, `code`)	formatted	formatted
angle-bracket URLs (<URL>, <URL|label>)	link	link
directive inside inline code (`<@U…>`)	resolved (chip rendered inside the code span)	resolved
directive inside fenced code (```\n<@U…>\n```)	resolved	resolved
escaped entities (&lt;@U123&gt; in payload)	literal <@U123>	literal <@U123>
bare URL (https://example.com)	plain text	autolinked
typed broadcast (@here, @channel, @everyone)	plain text	chip
typed channel (#general)	red highlight	red highlight
typed user (@somebody)	plain text	plain text
emoji (:eyes:)	rendered	rendered
nested formatting (*bold _and italic_ here*)	both	both

Net effect for this library: verbatim: true only behaves differently from verbatim: false in one way that matters here — typed bare @here / @channel / @everyone should render as plain text. (Bare URL autolinking is the other Slack difference, but this library doesn't autolink bare URLs in either mode.) Implementation: two yozora parser instances; the verbatim instance constructs SlackBroadcastTokenizer with matchTypedBroadcast: false. Bracket-form <!here> still resolves in both modes.

Known divergences from Slack (tracked separately)

Slack diverges from CommonMark in a few places where this library still follows CommonMark. Out of scope for this PR — they each need their own behavioral discussion and shouldn't ride along:

• Directives inside inline code — Slack resolves `<@U123>` to a chip rendered inside the code-styled span; this library leaves it literal. Needs a custom inline-code tokenizer or an AST-walk that splits inlineCode node values.
• Directives inside fenced code — same story, resolves in Slack but stays literal here.
• Blockquote in section/mrkdwn — Slack ignores leading > in section blocks; this library renders it as a blockquote. Pre-existing, not introduced by this PR. (One adjacent effect of moving entity decoding to render time: user-typed > quote delivered as > quote no longer triggers a blockquote either, which actually aligns better with Slack.)

Breaking-change risk

None expected. This is strictly more behavior:

• The hooks.user / channel / usergroup types already declare style? as optional, so adding style: undefined is type-compatible.
• Non-directive text (URLs, *bold*, _italic_, blockquotes, code spans, lists) renders exactly as before in verbatim: false.
• In verbatim: true, the new behavior is strictly more correct against Slack's own renderer.
• Escaped-entity rendering now matches Slack — a user typing <@U123> literally no longer produces a false mention chip.

Tests

The repo had no test framework. Added vitest + @testing-library/react + happy-dom. 50 tests covering:

• Per-directive × verbatim-mode matrix for user, channel, usergroup, broadcast (bracket form), date — bare and |fallback forms.
• Hook payload shape parity with rich_text path ({ id, name, style }).
• Data-map resolution (resolved name when id is known; raw id otherwise).
• Typed-broadcast suppression: @here / @channel / @everyone fire hooks in verbatim:false but not in verbatim:true; bracket-form <!here> always fires.
• DOM-equality test: verbatim:true and verbatim:false produce identical output for non-typed-broadcast content.
• Code-span suppression — flagged as "known divergence from Slack" in the test description so a future reader knows it's deliberate.
• Escaped entities — & decoding in link URLs, escaped <@U123> / <#C123> / <!here> stay literal, & / < / > decode in plain text, and decoding works inside inline and fenced code.
• Regression — bold, italic, inline code, angle-bracket URLs.

Run with pnpm test. pnpm run lint (tsc) and pnpm run build also pass.