Rebuild the vendored marked bundle at 18.0.11 (#123)

The weekly vendored-dependency check found `marked` pinned at 18.0.10 in
`scripts/vendor-marked.sh` while upstream publishes 18.0.11. The other
three pins the check covers — `highlight.js` 11.12.0, `@pierre/diffs`
1.3.6, `shiki` 4.4.3 — are already current, so this is the only drift
this week.

The fix bumps `MARKED_VERSION` and reruns `scripts/vendor-marked.sh`, so
the commit carries the rebuilt `skills/leaf/assets/vendor/marked.esm.js`
rather than the version string alone. `vendor-marked.sh` copies
upstream's single ESM file, so the bundle tracks the version directly
and nothing else feeds it.

Verified with `uv run pytest tests` (723 passed, 6 skipped) and the
browser file that owns the bundle's only importer, `uv run pytest
tests/test_render_conversations.py --run-nightly` (47 passed) —
`skills/leaf/assets/runtime/conversation/messages.js` is the sole place
`marked.esm.js` is imported.

<details><summary>Upstream 18.0.11 release notes</summary>

Patch release, three bug fixes, no API change
([v18.0.10...v18.0.11](markedjs/marked@v18.0.10...v18.0.11)):

- do not nest a link inside a link
([#4051](markedjs/marked#4051))
- `inlineTokens` rebuilds the reflink-mask preamble per call
([#4040](markedjs/marked#4040))
- keep emphasis in the text of a rejected reference link
([#4059](markedjs/marked#4059))

The bundle is minified, so its diff reads as one reflowed line; the
header comment moving from `marked v18.0.10` to `marked v18.0.11` is the
readable part.

</details>

Co-authored-by: leaf-agent <318509791+leaf-agent@users.noreply.github.com>

Author: leaf-agent

scripts/vendor-marked.sh

@@ -9,7 +9,7 @@
 # loaded, in leaf.js, not patched here.
 set -euo pipefail
 
-MARKED_VERSION=18.0.10
+MARKED_VERSION=18.0.11
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 OUT="$ROOT/skills/leaf/assets/vendor/marked.esm.js"