Add explicit prompt source trust controls

[dermatthes]

Summary

• add allowInstructions: bool = false to content prompt types
• render explicit external/untrusted data vs instruction-enabled source policies
• keep direct string prompt shorthand instruction-enabled for backwards-compatible task prompts
• treat PromptFile bodies as instructions while keeping references untrusted unless allow_instructions: true
• document the trust model in PromptType PHPDoc and .ai-usage-info.md
• add regression coverage for defaults, opt-in rendering, and PromptFile references

Validation

• branch is rebased onto current main and squashed to one commit
• GitHub Actions test workflow should validate the PHPUnit suite on this PR