Prompt injection is a trust-boundary bug in the retrieval pipeline

Retrieved text and operator instructions share one channel, so prompt wording cannot be the boundary. Where the exposure actually lives and the containment controls that hold.