fix(graph): auto-merge only schema-declared keys from llm output

state_updates::apply merged EVERY top-level key of an llm/agent node's JSON
output into graph state whenever the node had an output_schema, and
structured::extract never validated the output against that schema. Any
prompt text able to steer the model — including plan/diff text pasted from a
repo under review — could therefore plant an undeclared key (e.g.
verification_commands) into state and overwrite a caller-declared value
before a downstream script consumed it.

- apply() now takes the node's output_schema and merges only keys present in
  schema.properties; undeclared keys are dropped. No schema, or a schema
  without an object properties map, merges nothing.
- Nodes without output_schema are unchanged (None == the old false path);
  explicit state_updates are unchanged and still see the full output via
  {{output.<key>}}, which remains the author-controlled way to lift a key.
- Callers: llm.rs, agent.rs (x2), rag.rs (None).
- Sweep test bundled_graph_output_schemas_declare_every_key_relied_on: for
  every bundled graph, every consumed state key has a declared writer
  (initial_state, variable, state_updates target, map key, script-emitted key,
  or an output_schema property), and no schema node's field list names a key
  its schema omits — so this restriction cannot silently break a shipped
  graph. It passes with no graph.yaml changes.
- graph.example.yaml documents the declared-keys-only merge; the residual
  disclosed in 665fee9's README/docstring notes is now recorded as closed.

assets/agents/adversary/README.md

@@ -139,10 +139,9 @@ as a structured `inputs:` passthrough, not as prompt text.
   an invalid declaration: `run_checks` executes **nothing** and records a
   `PIPELINE-FAULT: verification_commands declaration invalid — …` marker, which forces DIVERGES —
   fail-closed, not degraded to the soft ENVIRONMENT marker.
-- Known residual: the engine merges every top-level key of `parse`'s JSON output into state, not
-  only the keys in its `output_schema`, so an injected instruction that makes the parse LLM emit an
-  extra `verification_commands` key is not yet blocked at the engine level. Closing that requires
-  restricting the llm-node auto-merge to `output_schema.properties` (tracked as a follow-up).
+- The engine merges only the keys declared under `parse`'s `output_schema.properties` into state,
+  so an injected instruction that makes the parse LLM emit an extra `verification_commands` key
+  cannot reach state: the undeclared key is dropped and the declared variable stands.
 
 ### Tools