fix(rag): close prompt-neutralizer bypass for cross-document titles

[BigSimmo]

Summary

docs/rag-injection-threat-model.md (Vectors B/C) established that a document
title/file_name is a viable injection channel and must never reach the model
raw — buildRagSourceBlock already neutralizes per-result titles for that
reason. This PR closes three places that built prompt text directly from
document titles without going through that same neutralizeIdentityField
primitive:

• buildCrossDocumentSourceGuide (src/lib/cross-document-synthesis.ts) —
  the per-document title in the "Cross-document synthesis guide:" block that
  feeds into the answer-generation prompt whenever cross-document synthesis
  is enabled.
• buildCrossDocumentFusionBrief (same file) — the per-document title in the
  "Fast fused source brief:" block.
• summarizeDocument (src/lib/rag.ts) — document.title interpolated raw
  into the Document: header of the single-document summary prompt, the
  highest-trust position in that prompt.

Why this wasn't already covered

tests/rag-injection.test.ts already covers neutralizeIdentityField and
buildRagSourceBlock's per-result title neutralization thoroughly, but these
three call sites build their own prompt strings from document titles
outside of buildRagSourceBlock, so they weren't exercised by that suite.

Testing

• Added two regression tests to tests/cross-document-synthesis.test.ts
  proving a canonical injection idiom carried in a document title no longer
  survives into the generated guide/brief text (same idiom pattern used in
  tests/rag-injection.test.ts).
• npx tsc --noEmit clean, npx eslint clean on all three changed files,
  npx vitest run tests/cross-document-synthesis.test.ts tests/rag-injection.test.ts
  — 17/17 passing.
• No schema.sql / migration changes — no drift-manifest dependency, unlike
  the sibling R17/R5 PRs from this session.

🤖 Generated with Claude Code

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.