fix(dsh): isolate recalled memory from prompt templates

[adoresever]

Root cause

DSH treats every dynamic context as prompt-template source. Graph Memory previously inserted recalled nodes and episodic messages directly into that source, so ordinary Vue, Handlebars, Liquid, Angular, or CI expressions could be parsed as DSH variables and abort the entire turn. Storage was not the problem; the missing data/template trust boundary was.

Architectural fix

• Contribute recalled memory through DSH's one-pass variable-value channel.
• Keep the context template limited to one plugin-owned placeholder.
• Preserve historical code byte-for-byte; substituted values are not scanned again by DSH.
• Allocate a deterministic suffix instead of overwriting another provider's variable.
• Keep assembleContext host-neutral and centralize this contract in one reusable helper.

Verification

• Real @deepseek-ai/dsh-system-prompt@0.0.1-rc.1: failure reproduced before the fix.
• Real renderer after the fix: render succeeds and Vue/Handlebars/GitHub Actions expressions are preserved exactly.
• 17 test files / 130 tests pass.
• npm run build and npm run build:dsh pass.

Thank you @meyaomiao for the detailed root-cause trace and local validation in #79, and @vongostev for independently reporting the same failure mode and emphasizing that even valid-looking variable names are unsafe in #80.

Closes #79
Closes #80