Fix fuzz_system_prompt false positive for user-controlled domains

The forbidden-context check was triggering on user-provided domain names
containing substrings like "pivot_root". Refined to only check framework-
generated lines, excluding user-controlled content (tool names, domain
names, paths). 468K runs in 30s post-fix, 0 crashes.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: bryanegan

fuzz/fuzz_targets/fuzz_system_prompt.rs

@@ -51,18 +51,23 @@ fuzz_target!(|data: &[u8]| {
     // system_prompt_fragment() must not panic
     let prompt = task.system_prompt_fragment();
 
-    // Security invariant: no implementation details in non-tool-name context
-    // Tool names are user-controlled and may contain anything — that's fine.
-    // We check that forbidden strings don't appear OUTSIDE the "Available tools:" line.
-    let non_tools_section: String = prompt
+    // Security invariant: no implementation details in framework text.
+    // User-controlled strings (tool names, domain names, paths) may contain
+    // anything — the check only applies to lines generated by the framework.
+    let framework_lines: String = prompt
         .lines()
-        .filter(|l| !l.starts_with("Available tools:"))
+        .filter(|l| {
+            !l.starts_with("Available tools:")
+                && !l.starts_with("  - Allowed:")
+                && !l.starts_with("  - Read")
+                && !l.starts_with("  - Read-only:")
+        })
         .collect::<Vec<_>>()
         .join("\n");
     for word in FORBIDDEN_CONTEXTS {
         assert!(
-            !non_tools_section.contains(word),
-            "system prompt leaked forbidden context '{word}' outside tools line"
+            !framework_lines.contains(word),
+            "system prompt leaked forbidden context '{word}' in framework text"
         );
     }