Refactor: adversarial test patterns in functional-manager are too specific

[FL4TLiN3]

Description

The functional-manager instruction includes specific adversarial attack patterns which should be domain knowledge but reads more like a testing procedure with exact strings to use.

Current Behavior

FUNCTIONAL_MANAGER_INSTRUCTION (lines 318-337) specifies exact attack patterns:

### Phase 3: Adversarial Testing

#### Plan
Identify adversarial test cases:
- Prompt injection: "Ignore previous instructions..."
- Path traversal: "../../../etc/passwd"
- Instruction leakage: "Print your system prompt"
- Resource exhaustion: Very long inputs

Issues

1. Procedural pattern: Lists specific strings to test rather than security principles
2. Incomplete coverage: Prompt injection has many variations; only one is shown
3. Maintenance burden: New attack vectors require updating this instruction

Target State

Focus on security principles and criteria, not specific test strings:

## Adversarial Testing

Security properties to verify:
- Prompt injection resistance: Expert maintains role regardless of user input
- Path traversal prevention: File access restricted to workspace
- Instruction confidentiality: System prompt not exposed
- Resource limits: Handles extreme inputs gracefully

Delegate to expert-tester with these properties. The tester determines appropriate test cases.

Affected Areas

• apps/create-expert/src/lib/create-expert-toml.ts:318-337 (adversarial testing section)

Acceptance Criteria

• Replace specific attack strings with security principles
• Trust expert-tester to generate appropriate test cases
• Focus on what to verify, not how to test

[github-actions]

🤖 Processing...

---