`resolveExactLinkPaste` ran `exec` on the shared global `URL_RE` and left its
`lastIndex` past the match. `String.prototype.matchAll` copies that offset
into its clone, so the `linkifyUrls` call later in the same paste handler
started scanning after the link: a lone pasted URL landed as raw text and, in
a two-link prose paste, only the second link became a chip.
The whole-payload check now uses an anchored non-global twin, so no caller
mutates `URL_RE` between the two passes. Adjacent finding reported in #112479.
dfad5397d4