fix(convex): stop agents echoing <untrusted_source> tags into replies

[larryro]

Problem

Agents occasionally reproduced raw <untrusted_source ...>...</untrusted_source> wrapper tags in their user-facing replies — sometimes once, sometimes around every fourth sentence. A teammate flagged it in a live chat (the model wrapped each cited fact in the literal tag).

Root cause

This is a prompt-design gap, not model misbehavior:

• We wrap every external tool result (web search, integrations like Tavily, RAG over external sources) in <untrusted_source> tags via wrapUntrusted() in lib/untrusted_content.ts. That's a deliberate prompt-injection defense — the tags tell the model "this is data, not instructions."
• But the system.untrusted_content TRUST RULES prompt only said "quote the URL attribute of the enclosing tag" and never stated that the tags are internal markers that must not appear in output.
• Models read "quote the enclosing tag" as a citation format and copied the whole wrapper through. It's intermittent because it depends on how the model chooses to cite that turn.

Fix

• system.untrusted_content: replace the ambiguous line with two explicit rules — cite via the url attribute as a normal markdown link, and never reproduce the <untrusted_source> opening/closing tags.
• researcher.json: same correction in the agent's inline TRUST RULES copy (it repeats the instruction and hits Tavily every turn, so it's the most visible offender).
• render.test.ts.snap: update the cache-critical prompt snapshot to match. ⚠️ This template feeds the prompt-cache stable prefix — any byte change invalidates caches platform-wide; the snapshot test guards it.

Scope of effect

The shared UNTRUSTED_CONTENT_SYSTEM_PROMPT covers every agent whose tools return external content, so fixing it in one place (plus the researcher's inline copy) cleans it up everywhere.

Tests

• render.test.ts — 14 passed (snapshot matches)
• example-agents-normalized.test.ts — 2 passed (researcher.json still valid/normalizes)

Not in scope

The separate question of why Tavily ran without being statically bound (composer capability-pill → per-turn dynamic binding via mergeCapabilityBindings) is untouched — can follow up separately if desired.