fix(agentic): guard Write against overwrite, allow loop recovery, and harden Write content generation

[bobleer]

Summary

Three related improvements that address recurring failure modes we have hit in real agent runs:

1. Write tool overwrite guard (file_write_tool.rs)

   • Write now refuses to overwrite an existing file and returns an error that points the model at the right alternatives: Edit to modify, or Delete followed by Write to fully rewrite.
   • The tool description is updated to match, so the model is steered toward the correct workflow up front.
   • Motivation: models occasionally regenerate files with incomplete content via Write, silently losing data. Edit is almost always the correct choice; full rewrites remain possible via the explicit Delete + Write sequence.

2. Recoverable loop detection (execution_engine.rs)

   • Both the consecutive-signature and periodic-signature loop detectors used to terminate the round on first detection.
   • They now inject a <system_reminder> user message describing the detected loop and asking the model to change strategy, granting up to 3 such recovery attempts (shared across both detectors) before falling back to the previous terminate-with-loop_detected behavior.
   • Reminders are persisted via SessionManager so the recovery is visible in transcripts.
   • The existing safety net is preserved — we still stop eventually — while genuine transient stalls become recoverable instead of fatal.

3. Write content generation: prompt + sanitization + omission warning (round_executor.rs)

   • Prompt is hardened to forbid omission placeholders (e.g. // rest of the code, // existing code unchanged) and stray markdown fences / wrapper XML, while explicitly allowing literal ... when it is genuine file content (XML/JSON/docs). An assistant prefill of <bitfun_contents>\n is added to bias raw-content output.
   • extract_bitfun_contents now sanitizes the body: strips thinking-style XML blocks (<think>, <reasoning>, <reflection>, <analysis>, including the non-standard <think ... > variants some reasoning models emit) and strips outer markdown code fences when they wrap the entire body.
   • A conservative detect_placeholder_patterns warning is added. It matches only comment-style omission phrases that are essentially never legitimate in real source/data files (e.g. // ... rest of the code, <!-- snip -->) and emits a warning only — it never blocks the write, because Write must remain general enough to produce any kind of file (including prose / XML that legitimately mentions those phrases).

Test plan

• cargo check --workspace
• cargo test -p bitfun-core --lib agentic::execution::round_executor — 29 tests passing, including new cases:
  • thinking-block stripping with attributes / non-standard close
  • markdown fence stripping (with and without <bitfun_contents> tags)
  • preservation of legitimate XML inside the body
  • placeholder detector positive cases (// ... rest of the code, # existing code unchanged, <!-- snip -->)
  • placeholder detector negative cases (XML data containing ... / "the rest of the story", prose discussing the phrase, plain TODO: / FIXME: comments)
• Manual smoke against a real agent session to confirm the loop-recovery reminder is delivered as a user message and the model can resume.