fix: address pr-bug-scan validated finding from #4955

Added doc-link [[target]] passthrough in replaceReferenceLinks (mirrors encoder guard) so colliding ref defs no longer rewrite [[X]] to [[X](url)]; doc-link node preserved.

src/renderer/src/components/editor/markdown-reference-link-normalization.ts

@@ -1,3 +1,5 @@
+import { parseMarkdownDocLink } from './markdown-doc-links'
+
 type ReferenceLinkDefinition = {
   label: string
   title: string | null
@@ -127,6 +129,20 @@ function replaceReferenceLinks(
       continue
     }
 
+    // Why: a doc/wiki link [[target]] must pass through verbatim, mirroring the
+    // encoder's own doc-link guard. Without this, an inner shortcut reference
+    // (e.g. [[H-279]] colliding with a [H-279]: url definition) gets rewritten
+    // to [[H-279](url)], destroying the doc-link node.
+    if (markdown[index + 1] === '[') {
+      const closingDocLinkIndex = markdown.indexOf(']]', index + 2)
+      if (closingDocLinkIndex !== -1 && parseMarkdownDocLink(markdown.slice(index + 2, closingDocLinkIndex))) {
+        result += markdown.slice(index, closingDocLinkIndex + 2)
+        isLineStart = false
+        index = closingDocLinkIndex + 2
+        continue
+      }
+    }
+
     const closingTextIndex = findClosingBracket(markdown, index + 1)
     if (closingTextIndex === -1) {
       result += markdown[index]