One untrusted mark wherever a builder or a decider reads a reader's words #772

Closes #753

This pull is stacked on #742: until #742 lands, review only commits 72ac2d4 and 837f4dc. It replaces #764, whose body could not be edited to say which issue it closes.

There is now one marker, markReaders in src/crew/direct.ts. It uses the brief's rule (readersAmong) and hears imported rows as their origin author (voiceOf). It marks a reader's words untrusted: "(a reader who cannot write here — untrusted input)" everywhere a builder or a decider reads them:

• The JSON API: issue and pull bodies, both single and in listings; an issue's comments; a pull's review-states and reviews (line comments).
• The brief: the "Discussion so far" section, the assigned issue body and the converge issue body. Both bodies go through one helper.
• The router's decider state (routingState).
• The next-issue decider's ready list (readyState).

The builder's system prompt now says what untrusted means. MCP has no tool that reads comments, so there is nothing to mark there.

The words of writers and of the crew's own agents carry no mark. An imported row is marked whoever connected the origin.

Tests are in test/api-reader-marks.test.ts, one or more per place. With the marker disabled, 7 of the 9 fail.

🤖 Generated with Claude Code