XSS via quote injection in renderEmail() (email autolink)

`renderEmail()` in `inline/LinkTrait.php` (lines 194-198, unchanged since 2014-10-10) escapes the parsed email address with `htmlspecialchars(..., ENT_NOQUOTES | ENT_SUBSTITUTE, 'UTF-8')`, which does **not** escape double-quote characters, and then interpolates it into a double-quoted HTML href attribute:

```php
protected function renderEmail($block)
{
$email = htmlspecialchars($block[1], ENT_NOQUOTES | ENT_SUBSTITUTE, 'UTF-8');
return "$email";
}
```

The email autolink regex in `parseLt()` (`/^<([^\s>]*?@[^\s]*?\.\w+?)>/`) allows `"` in the local part. Input `<"onmouseover=alert(1)//@x.y>` is parsed as an email autolink and rendered as:

```

"onmouseover=alert(1)//@x.y

Verified with **html5lib** (faithful HTML5 tokenizer): the browser parses this as `` — a **live `onmouseover` event handler**. On hover, `alert(1)` executes.

```php
protected function renderEmail($block)
{
$email = htmlspecialchars($block[1], ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
return "$email";
}
```

## Reproduction

```php
parse('<"onmouseover=alert(1)//@x.y>'), PHP_EOL;
```

Output:
```

"onmouseover=alert(1)//@x.y

Independent discovery during a security audit. Verified novel: OSV empty, GitHub Advisory DB empty, no prior issue/comment mentions `renderEmail`/`mailto`/`ENT_NOQUOTES`.

Start in inline/LinkTrait.php at renderEmail() and trace how parseLt() sends email autolinks there. Reproduce the quoted local-part input from the issue, then add coverage for the generated HTML. Done means quotes in an autolink cannot become HTML attribute syntax or an event handler, while ordinary email autolinks still render correctly.

Written by the indexing model from the issue text.