fix(boundaries): keep Markdown separators inside wrapped content - #201

Fixes #192.

strip_boundary_markers split the wrapped block on "---\n" with maxsplit=2 and took parts[1]. The wrapper writes a delimiter on either side of the body, so that works until the body contains a --- line of its own, at which point the second split lands on the body's separator instead of the wrapper's closing one and everything after it is dropped. No error, no truncation marker, just a shorter string.

A --- line is ordinary Markdown and common in retrieved documents, which is exactly the content this wrapper exists to carry.

The body is whatever sits between the first delimiter and the last one, so the fix reads one delimiter in from each end with partition and rpartition and keeps every byte between them. The delimiter itself moved to a module constant that both the writer and the reader use, since the bug was the two halves disagreeing about which --- was structural.

Two cases beyond the report also truncated and now round-trip: a body that is exactly ---, and a body ending in ---.

body                                        before            after
# Notes\n\nBefore\n---\nAfter\n\nFinal...   '# Notes\n\nBefore'   round-trips
Section 1\n---\nSection 2\n---\nSection 3   'Section 1'           round-trips
---                                         ''                    round-trips
A\n---                                      'A'                   round-trips

A block with no delimiters at all is still replaced with the removal marker rather than returned, so a forged wrapper does not get its contents handed back.

Tests: six parametrised round-trips over the separator shapes, one that asserts the reported content survives rather than only that the string changed, and one for the no-delimiter block. The existing round-trip test passed throughout because its body has no internal separator, which is why this had no coverage.

ruff check, ruff format --check, mypy (128 files) clean. 248 tests across tests/unit/core/agent, tests/security and the public import surface. No doc drift, lock clean.