fix(markdown): preserve URLs inside inline code spans (#4681)

Inline backtick spans were converted to <code> only at the end of
mdToHtml, after the bare-URL autolink and <a>/allowed-HTML passes. A URL
inside inline code is preceded by a space, so the autolink wrapped it in
an <a> tag and swapped it for an ___ALLOWED_HTML_ placeholder, corrupting
commands like `irm http://127.0.0.1:3000/x`.

Extract inline code into placeholders before the link passes, mirroring
the existing fenced-code-block handling, and restore them last so
placeholders carried inside restored <a> blocks resolve. Escape the code
at extraction time since it now bypasses the global escape pass.

tests/test_markdown_rendering_js.py

@@ -170,6 +170,36 @@ def test_extract_thinking_blocks_handles_thought_tag(node_available):
     assert result["content"] == "Final answer."
 
 
+def test_url_inside_inline_code_is_not_autolinked(node_available):
+    # A URL inside a backtick span is preceded by a space, so the bare-URL
+    # autolink used to wrap it in an <a> tag (then swap it for an
+    # ___ALLOWED_HTML_ placeholder), corrupting the command shown to the user.
+    html = _run_markdown_case("Run `$j = irm http://127.0.0.1:3000/x` to fetch.")
+
+    assert "<code>$j = irm http://127.0.0.1:3000/x</code>" in html
+    assert "___ALLOWED_HTML_" not in html
+    assert "<a " not in html
+    assert 'href="http://127.0.0.1:3000/x"' not in html
+
+
+def test_url_outside_inline_code_is_still_autolinked(node_available):
+    # Inline code must not disable autolinking for bare URLs elsewhere in the
+    # same line.
+    html = _run_markdown_case("Use `irm` then visit https://example.com/page now.")
+
+    assert "<code>irm</code>" in html
+    assert 'href="https://example.com/page"' in html
+
+
+def test_inline_code_content_is_html_escaped(node_available):
+    # Inline code is now extracted before the global escape pass, so it must be
+    # escaped at extraction time (matching the fenced-code-block handling).
+    html = _run_markdown_case("Render `<b>$1 & 'q'</b>` literally.")
+
+    assert "<code>&lt;b&gt;$1 &amp; &#39;q&#39;&lt;/b&gt;</code>" in html
+    assert "<b>" not in html
+
+
 def test_dotted_python_import_paths_are_not_autolinked(node_available):
     html = _run_markdown_case(
         "from imblearn.combine import SMOTETomek\n"