security(llm): mitigate prompt injection via spec/file content (F-11)

[gibbon]

User-supplied spec values and file contents are inlined into draft/enrich prompts. Wrap them in delimited blocks (e.g. <USER_SPEC>...</USER_SPEC>) and document the inherent LLM-prompt-injection risk in docs/llm.md. See F-11.

[gibbon]

Fixed in v0.2.2. Spec/file content wrapped in <USER_DESCRIPTION>/<USER_SPEC>// delimiters with explicit trust-model in system prompt.