fix: sanitize state values substituted into instruction templates

[g0w6y]

Problem

injectSessionState() replaces {var_name} placeholders in an agent's
instruction string with values from two sources:

• session state — {role} → session.state['role']
• artifacts — {artifact.report} → artifact file content

Both paths returned the raw string with no escaping. A value containing
HTML special characters such as <, >, or & would be embedded
directly into the system prompt without sanitization.

Fix

Escape HTML entities in every substituted value before inserting it into
the template. Applied to both the state injection path and the artifact
injection path:

return String(value)
  .replace(/&/g, '&')
  .replace(/</g, '&lt;')
  .replace(/>/g, '&gt;');

The order matters — & is replaced first to avoid double-escaping
sequences like < into <.

Example

Before

state:   { snippet: '<script>alert(1)</script>' }
prompt:  'code={snippet}'

sent to model: 'code=<script>alert(1)</script>'

After

sent to model: 'code=<script>alert(1)</script>'

Changes

• core/src/agents/instructions.ts — escape &, <, > in both the
  state injection path and the artifact injection path
• core/test/agents/instructions_test.ts — update existing assertions to
  expect escaped output; add new sanitization tests covering individual
  character escaping, combined escaping, and double-escape prevention

[kalenkevich]

Thanks, can you include tests as well?

[g0w6y]

@kalenkevich Added tests covering the sanitization behavior for both state and artifact injection paths — all 23 pass. Ready for re-review

[g0w6y]

@kalenkevich removed the <value> wrapper as discussed — now only HTML entity escaping is applied on both the state and artifact injection paths. Tests updated accordingly. Please take a look when you get a chance.