Summary

CommonMark §2.3 requires literal U+0000 characters to be replaced with U+FFFD.
Marko already does this for entity references like � and �, but literal NUL characters in the input are currently preserved in the rendered HTML.

Reproduction

import marko
print(repr(marko.convert("a\x00b")))
# current:  '<p>a\x00b</p>\n'
# expected: '<p>a�b</p>\n'

print(repr(marko.convert("`a\x00b`")))
# current: '<p><code>a\x00b</code></p>\n'

print(repr(marko.convert("&#0;")))
# already correct: '<p>�</p>\n'

The same issue also happens inside fenced code blocks.

Fix

Apply the \x00 to � substitution in _preprocess_text() after line-ending normalization.
This makes all parser and renderer paths see the same sanitized input, and keeps the behavior consistent with the existing entity-reference handling.

Tests

Added regression tests for:

• NUL in plain text
• NUL inside a code span
• NUL inside a fenced code block

All existing tests still pass.