Assert parser UTF-16 input invariant

[bobzhang]

Summary

• Assert in Parser::new that parser input is well-formed UTF-16
• Panic with a clear message on unpaired surrogate code units instead of silently repairing invalid input
• Add black-box renderer tests documenting valid astral input and malformed-surrogate panic cases

Scope

This is the parser-boundary invariant slice extracted from #127. It intentionally avoids adding a public sanitizer API: the parser maintains the invariant that its MoonBit String input is well-formed, and malformed surrogate code-unit sequences are treated as programmer error from unsafe or host-side construction.

This PR is stacked after #135 because the earlier PRs fix the shared UTF-16 helpers, renderer handling, and valid-Unicode scanner indexing.

Dependency order: #132 -> #134 -> #135 -> this PR.

Validation

• moon test src/cmark_html --target wasm-gc
• moon check --warn-list +unnecessary_annotation
• moon test
• moon info