fix(graph): auto-merge only schema-declared keys from llm output

state_updates::apply merged EVERY top-level key of an llm/agent node's JSON
output into graph state whenever the node had an output_schema, and
structured::extract never validated the output against that schema. Any
prompt text able to steer the model — including plan/diff text pasted from a
repo under review — could therefore plant an undeclared key (e.g.
verification_commands) into state and overwrite a caller-declared value
before a downstream script consumed it.

- apply() now takes the node's output_schema and merges only keys present in
  schema.properties; undeclared keys are dropped. No schema, or a schema
  without an object properties map, merges nothing.
- Nodes without output_schema are unchanged (None == the old false path);
  explicit state_updates are unchanged and still see the full output via
  {{output.<key>}}, which remains the author-controlled way to lift a key.
- Callers: llm.rs, agent.rs (x2), rag.rs (None).
- Sweep test bundled_graph_output_schemas_declare_every_key_relied_on: for
  every bundled graph, every consumed state key has a declared writer
  (initial_state, variable, state_updates target, map key, script-emitted key,
  or an output_schema property), and no schema node's field list names a key
  its schema omits — so this restriction cannot silently break a shipped
  graph. It passes with no graph.yaml changes.
- graph.example.yaml documents the declared-keys-only merge; the residual
  disclosed in 665fee9's README/docstring notes is now recorded as closed.

assets/agents/adversary/scripts/run_checks.py

@@ -18,10 +18,10 @@ shell=True. Variables land in state as strings, so a JSON-encoded list is
 accepted alongside a real list. A declaration that is not a JSON array of
 strings is a caller contract violation, not a runner hiccup: it executes
 NOTHING and records a PIPELINE-FAULT (fail-closed into DIVERGES) instead of
-degrading to the soft ENVIRONMENT marker. Known residual: the engine merges
-every top-level key of an llm node's JSON output into state, so a parse LLM
-coaxed into emitting an extra `verification_commands` key could still
-overwrite the declared value before this script runs.
+degrading to the soft ENVIRONMENT marker. The engine merges only the keys an
+llm node's `output_schema.properties` declares, so a parse LLM coaxed into
+emitting an extra `verification_commands` key cannot overwrite the declared
+value: the undeclared key is dropped before it reaches state.
 
 Budget: commands run sequentially, so TOTAL runtime is bounded by a deadline
 (TOTAL_DEADLINE_SECS = 3300s, the run_checks node's 3600s timeout minus