slice-refactor

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Step 3/4 load and read .substrate/anti-pattern/INDEX.md and matching anti-pattern bodies plus docs/plans/<workflow_id>.md and full test files; these are free-form markdown authored by parties other than the operating user (public/repo content), which can contain outsider text that becomes LLM-readable context.