fix(untrusted): neutralize fuzzy closing-tag variants in wrap_untrusted

[viistaproducts]

What

wrap_untrusted only escaped the exact byte string </event_content>. Whitespace- or case-varied closing tags slip through unescaped:

</event_content>    -> escaped ✓
</event_content >   -> NOT escaped ✗   (trailing space)
</EVENT_CONTENT>    -> NOT escaped ✗   (uppercase)
< / event_content > -> NOT escaped ✗   (spaces around slash)
</event_content\t>  -> NOT escaped ✗   (tab)

Since LLMs don't parse XML strictly, a fuzzy closing tag can still read as the delimiter's end to the model, letting an attacker's subsequent text be interpreted as instructions rather than data — the exact break-out the wrapper exists to prevent. The docstring also claimed an attacker "cannot inject a fake </event_content>", which overstated the guarantee.

Change

• Replace the literal str.replace with a case-insensitive, whitespace-tolerant regex over closing-tag variants only (requires the slash). Being close-only preserves the existing re-wrap idempotency contract (an inner opening tag is never escaped), which test_wrap_untrusted_idempotent_in_content_does_not_corrupt pins.
• Corrected the docstring to describe the actual (now stronger) guarantee.
• Added test_wrap_untrusted_neutralizes_fuzzy_closing_tags covering the four variants above.

Defense-in-depth: the UNTRUSTED_CONTENT_DIRECTIVE still instructs the model to ignore embedded directives; this closes the delimiter-escape gap that sat behind it.

Tests

tests/test_untrusted.py (12 passed), plus the UNTRUSTED-referencing suites test_schema_evolver.py + test_self_improvement_hardening.py (62 passed total). ruff check, ruff format --check, and mypy all clean.

🤖 Generated with Claude Code