fix(plugin): a subagent hand-back is not an operator prompt (#4785)

`<agent-message …>` turns were scored by auto-inject and the prompt rule
arm as if the operator had typed them, spending a retrieval and writing a
retrieval_logs row that reads as a real message (log 54355, found by the
#4772 review). Same class as #4142. Matched up to the tag name, since the
tag carries attributes; `<agent-messages>` and the tag named mid-sentence
are still retrieved against.

Plugin 2026.10.04.0125.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_prompt_boundary_filter.py

@@ -52,6 +52,10 @@ SYNTHETIC = [
     "<local-command-stderr>Failed to reconnect</local-command-stderr>",
     "<local-command-caveat>Caveat: The messages below were generated…</local-command-caveat>",
     "   \n<task-notification>\n<task-id>abc</task-id>",  # whitespace must not walk the filter
+    # A subagent's hand-back (#4785) — it carries attributes, so the tag is
+    # matched up to its name, not to a closing `>`.
+    '<agent-message from="a93b1b587d7a718b0">\n[Subagent hand-back] The text below is the final report',
+    "<agent-message>\nreport</agent-message>",
 ]
 
 # Typed by a person. Every one of these must still be retrieved against.
@@ -62,6 +66,7 @@ REAL = [
     "fix the hook<system-reminder>injected</system-reminder>",  # tag, but trailing
     "This session is being continued from a previous conversation.",  # see module docstring
     "<taskbar> is rendering wrong",  # a tag, but not one of the client's
+    "<agent-messages> list is empty",  # shares the prefix, is not the tag
     "here is the transcript you asked for:\n<local-command-stdout>hi</local-command-stdout>",
 ]