Rebuild the vendored marked bundle at 18.0.11

[leaf-agent]

The weekly vendored-dependency check found marked pinned at 18.0.10 in scripts/vendor-marked.sh while upstream publishes 18.0.11. The other three pins the check covers — highlight.js 11.12.0, @pierre/diffs 1.3.6, shiki 4.4.3 — are already current, so this is the only drift this week.

The fix bumps MARKED_VERSION and reruns scripts/vendor-marked.sh, so the commit carries the rebuilt skills/leaf/assets/vendor/marked.esm.js rather than the version string alone. vendor-marked.sh copies upstream's single ESM file, so the bundle tracks the version directly and nothing else feeds it.

Verified with uv run pytest tests (723 passed, 6 skipped) and the browser file that owns the bundle's only importer, uv run pytest tests/test_render_conversations.py --run-nightly (47 passed) — skills/leaf/assets/runtime/conversation/messages.js is the sole place marked.esm.js is imported.

Upstream 18.0.11 release notes

Patch release, three bug fixes, no API change (v18.0.10...v18.0.11):

• do not nest a link inside a link (#4051)
• inlineTokens rebuilds the reflink-mask preamble per call (#4040)
• keep emphasis in the text of a rejected reference link (#4059)

The bundle is minified, so its diff reads as one reflowed line; the header comment moving from marked v18.0.10 to marked v18.0.11 is the readable part.

[leaf-agent]

Verified independently of the PR body, since the whole change rests on the bundle really being upstream: the committed skills/leaf/assets/vendor/marked.esm.js is byte-identical to package/lib/marked.esm.js from npm pack marked@18.0.11, and 18.0.11 preserves the two behaviours messages.js configures — the escaping html renderer override still catches block and inline raw HTML (<script>…</script>, <img src=x onerror=…>, and Vec<T> all escape to their characters) and breaks: true still yields <br> on a single newline. Both suite figures reproduce here: 723 passed / 6 skipped, and 47 in tests/test_render_conversations.py --run-nightly. 18.0.11 is upstream's current release, and the four pins the weekly step covers are the only references to a marked version in the tree.

One thing this week's run surfaced that isn't a change to this PR: the weekly vendored-dependency step in .claude/skills/running-tend/SKILL.md greps four pins — HLJS_VERSION, MARKED_VERSION, PIERRE_VERSION, SHIKI_VERSION — while scripts/CLAUDE.md documents six vendor scripts. MERMAID_VERSION in scripts/vendor-mermaid.sh and PLOT_VERSION in scripts/vendor-plot.sh are watched by neither that step nor .github/dependabot.yml, so they drift with nothing to catch them — which is the same rationale the step gives for the four it does list. Both are current today (mermaid 11.17.2, @observablehq/plot 0.6.17), so this week's "only drift" conclusion holds; the gap is that a future drift in those two goes unseen. Recording it here rather than opening a seventh bot PR — the open queue is already over budget, and this is a coverage gap in the check, not a wrong outward action.