fix(agent-context): isolate untrusted recall synthesis evidence

[levineam]

Motivation

• Prevent untrusted retrieval text (GBrain/QMD) from being promoted into top-level assistant context where prompt-injection payloads could be mistaken for instructions.
• Preserve auditability by keeping the original source bundle available while ensuring the synthesis section cannot be interpreted as executable guidance.
• Add regression coverage to ensure maliciously-crafted retrieval lines (including embedded Markdown fences) cannot escape the untrusted boundary.

Description

• Change modules/jarvos-agent-context/src/index.js synthesizeRecall rendering to label retrieved evidence as untrusted and serialize evidence and relatedGraphNodes inside a json code fence instead of emitting raw bullets.
• Keep the existing ## Source Bundle output intact so the full fenced bundle remains available for audit.
• Add a unit test in modules/jarvos-agent-context/test/agent-context.test.js that simulates malicious GBrain output containing an exfiltration instruction and an embedded fence, and asserts the text is not emitted as top-level bullets but is contained within the JSON fence.

Testing

• Ran node --test modules/jarvos-agent-context/test/agent-context.test.js and the suite passed (44 tests, all passing).
• Ran the broader smoke checks with node tests/modules-smoke-test.js and all checks passed (74 checks, all passing).
• Verified the new regression test specifically asserts the untrusted evidence warning and JSON fencing behavior and passed.

---

Codex Task