fix(preview): fence version cells so a backtick cannot break the PR comment table

[BryanFRD]

Closes #1234

The version columns of the preview comment were wrapped in a single-backtick code span and passed through escape_md_cell, which escapes with backslashes. Markdown ignores backslash escapes inside a code span, so a backtick in a version still closed the span, and \ or < showed up literally.

Version cells now go through code_cell: the fence is one backtick longer than the longest run in the value, padded with a space when the value starts or ends with a backtick, as CommonMark specifies. Inside the span only | is escaped (GFM splits table cells before inline parsing) and newlines become spaces. Everything else stays literal, which is safe because a code span renders nothing as HTML. Name and bump cells keep escape_md_cell.

The existing hostile-input test asserted the broken output; it now expects the fenced form.

[ferrfleet]

Nothing blocking. code_cell follows CommonMark code span rules. The fence is one backtick longer than the longest run inside, so the span can't close early. The padding is only added when the value starts or ends with a backtick, and the renderer strips exactly that one space. Leaving HTML entities unescaped is correct here, because inside a code span they would show up literally. \| is the GFM-sanctioned way to keep a pipe inside a code span in a table cell. The tests cover the cases that matter, including the empty value.