fix(chat): keep a reply that quotes <proposed_plan> out of a plan card

The adapter lifted codex's Plan-mode block out of assistant text by matching
`<proposed_plan>` as a bare substring on every assistant text block, whatever
agent wrote it, so a reply that merely mentioned the tag tripped the detector. A
single unclosed opener was enough to take the rest of the message: with no
closing tag the block reads as still streaming and its body becomes everything
that follows, so a Claude Code reply explaining this parser broke off mid-
sentence and the remainder of its text — several paragraphs — reappeared inside a
"Proposed plan" card. It was never agent-specific; the one place codex names the
tag in its own prose was mis-lifted the same way.

An occurrence markdown renders as literal code is now skipped, since quoting the
tag is not emitting it, and an opener must additionally start its own line within
CommonMark's indent threshold. Both rules carry weight rather than one backing up
the other: while a turn streams, the closing backtick of a code span has not
arrived yet and the quote is not yet recognisable as one, so the line-start rule
is what keeps a half-typed sentence from flashing a plan card. Where the two
disagree with strict CommonMark they are deliberately conservative in the same
direction, because the costly error is suppressing a real plan, not missing an
exotic quote: inline spans are matched within a single line, so a stray backtick
marks nothing instead of masking the document after it, and the closing tag is
held to the code rule alone — an unrecognised closer would drag trailing prose
into the card, which is worse than a card that ends early. A CRLF line keeps its
carriage return, which `.` never matches, so fences are matched against the line
without it; left in, it would have quietly disabled the fenced-block rule on
Windows-style text.

Text that carries only quoted tags falls through unchanged to the ordinary text
path, so such a message renders verbatim, backticks and all. Checked against the
local corpus: across 2816 rollouts the 14 real plans still lift, and every
occurrence that no longer does is prose about the tag.