Harden internal LLM prompt boundaries

[mylukin]

Summary

• Add shared XML prompt-boundary helpers for untrusted text and JSON payloads.
• Wrap Helm-owned internal LLM inputs in explicit XML sections, including classifier eval user text and memory LLM messages/observations.
• Add regression coverage for XML breakout attempts and preserve the existing memory system-reminder filtering behavior.
• Record the implementation decision in implementation-notes.md.

Validation

• corepack pnpm exec vitest run apps/gateway/src/routes/classify.test.ts apps/gateway/src/memory-llm.test.ts
• corepack pnpm typecheck
• corepack pnpm lint
• corepack pnpm build
• git diff --check

Note

The inspected Feishu reply-gate prompt is an external caller request to /v1/chat/completions, so Helm cannot automatically infer trusted and untrusted sections inside that business prompt. This PR hardens Helm-owned internal LLM prompts; the caller that constructs the Feishu gate prompt should also XML-wrap its policy, runtime context, history, latest message, and output contract sections.