feat(md, cli): Stream top-level paragraphs incrementally

[JeanMertz]

Long assistant paragraphs — a single prose line with no internal newlines — previously stalled the terminal until the whole paragraph arrived, sometimes over a minute for a reasoning block. The buffer now streams a top-level paragraph incrementally as its content grows, so output appears as it is generated rather than only when the block terminates.

Streamed output is byte-for-byte identical to whole-paragraph rendering: the renderer accumulates the paragraph's source, re-renders the growing buffer on each chunk, and prints only the stable committed prefix (everything up to the last wrapped newline), holding the in-progress visual line until a later chunk or the terminator commits it. The concatenation of all printed deltas equals format_terminal_with(full_paragraph, opts) exactly.

Several guards manage the ambiguities that would otherwise break that guarantee:

• Block-start — the partial-line classifier enters paragraph mode as soon as the line's first non-space character rules out every block starter (header, fence, list, HTML, thematic break, reference, table), so a leading # / ` / | / digit / etc. waits for the newline.
• Setext threshold — a source-byte threshold (~128) holds the first line or two so a short setext underline can still turn a run into a heading.
• Inline ground state — the committed prefix never ends inside an open inline construct (emphasis, code span, link, angle bracket).
• Tables — a block whose header line begins with a pipe is kept whole and never streamed, because a table's column widths depend on its later rows and so its rendering is not prefix-stable.
• Wrap-in-progress — the renderer holds the in-progress visual line until it is committed.

Byte-identity has two documented exceptions, both almost never produced by LLM output: a setext heading whose content exceeds the threshold streams as prose instead of becoming a heading, and a GFM table whose header has no leading pipe (legal per the GFM spec but unexemplified there) is not detected and may stream with mis-padded columns.

Buffer::with_streaming_paragraphs(false) opts out, restoring whole-paragraph Event::Block emission. Event gains #[non_exhaustive] alongside the new Event::ParagraphChunk variant, so this is the last forced match-site breakage. OrphanedFenceFixup derives its embedded-fence flag from the accumulated paragraph source rather than a single Event::Block, since the inline scanner can split an embedded fence across chunk boundaries.

Tested by a byte-identity harness (streamed vs. whole, with per-shape latency assertions) over an adversarial corpus, plus an expanded set of flowing-markdown fixtures cross-validated against comrak; the buffer-half of the guarantee is checked over the fixture corpus in jp_md.

The design and guards are documented in RFD 089.