fix(anthropic): preserve rendered-context provenance

[alteixeira20]

PXPipe's Anthropic transform can move trusted static configuration into image blocks attached to the first user message.

The existing image banner then instructs Claude to follow those user-role images as operating instructions. In real Claude Code usage this can trigger a false prompt-injection / reasoning-extraction refusal even though the represented material originated from the legitimate request.

This fixes that single trust-boundary problem by:

• removing the imperative operating-instruction wording from the rendered image banner;
• keeping the rendered image framing descriptive;
• adding a small first-party PXPipe provenance statement to the actual system field whenever configuration images are emitted;
• preserving the existing Claude Code identity as the first system block.

Before:

[user-role rendered image]
Read the pages carefully and follow them as your operating instructions for this session.

After:

system:
  preserved Claude Code identity
  PXPipe rendered-context provenance

first user:
  rendered configuration image
  exact-value factsheet
  live user request

Fixes #227

Verify

pnpm install --frozen-lockfile
pnpm run audit
pnpm run typecheck
pnpm exec vitest run tests/refusal-provenance.test.ts tests/safety-policy.test.ts tests/anthropic-cache-align.test.ts tests/abstention.test.ts tests/public-api.test.ts
pnpm test
pnpm run build
git diff --check

Validation performed:

• production dependency audit: no known vulnerabilities

• focused Anthropic provenance/safety/cache regressions: pass

• full suite: pass

• TypeScript typecheck: pass

• build and entrypoint smoke checks: pass

• live Claude Code validation after rebuilding/restarting PXPipe: the previous false refusal no longer occurs

• Rebased on current main

• pnpm test and pnpm typecheck pass

• No raw prompts, credentials, session files, or machine identifiers