fix(plugin): a subagent hand-back is not an operator prompt (#4785)

`<agent-message …>` turns were scored by auto-inject and the prompt rule
arm as if the operator had typed them, spending a retrieval and writing a
retrieval_logs row that reads as a real message (log 54355, found by the
#4772 review). Same class as #4142. Matched up to the tag name, since the
tag carries attributes; `<agent-messages>` and the tag named mid-sentence
are still retrieved against.

Plugin 2026.10.04.0125.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "scribe",
   "description": "Scribe for Claude Code: connects the scribe MCP server, adds the hooks that deliver live project state and relevant records at the right moment, ships the shared client-neutral Scribe skills (using-scribe, writing-plans, reporting-back, systematic-debugging, verification, brainstorming, reusing-code, shape-accounting), and syncs your saved Scribe Processes as skills (/scribe:sync).",
-  "version": "2026.10.03.1934",
+  "version": "2026.10.04.0125",
   "author": {
     "name": "Bryan Van Deusen"
   },

plugin/hooks/scribe_defs.sh

@@ -79,6 +79,7 @@ scribe_skip_prompt() {
   _scribe_prompt=${1#"${1%%[![:space:]]*}"}
   case "$_scribe_prompt" in
     "<task-notification>"*|\
+    "<agent-message>"*|"<agent-message "*|\
     "<command-name>"*|"<command-message>"*|"<command-args>"*|\
     "<local-command-stdout>"*|"<local-command-stderr>"*|"<local-command-caveat>"*)
       return 0 ;;

tests/test_prompt_boundary_filter.py

@@ -52,6 +52,10 @@ SYNTHETIC = [
     "<local-command-stderr>Failed to reconnect</local-command-stderr>",
     "<local-command-caveat>Caveat: The messages below were generated…</local-command-caveat>",
     "   \n<task-notification>\n<task-id>abc</task-id>",  # whitespace must not walk the filter
+    # A subagent's hand-back (#4785) — it carries attributes, so the tag is
+    # matched up to its name, not to a closing `>`.
+    '<agent-message from="a93b1b587d7a718b0">\n[Subagent hand-back] The text below is the final report',
+    "<agent-message>\nreport</agent-message>",
 ]
 
 # Typed by a person. Every one of these must still be retrieved against.
@@ -62,6 +66,7 @@ REAL = [
     "fix the hook<system-reminder>injected</system-reminder>",  # tag, but trailing
     "This session is being continued from a previous conversation.",  # see module docstring
     "<taskbar> is rendering wrong",  # a tag, but not one of the client's
+    "<agent-messages> list is empty",  # shares the prefix, is not the tag
     "here is the transcript you asked for:\n<local-command-stdout>hi</local-command-stdout>",
 ]