Fixes #327467

What changed

• XML-entity encode every dynamic instruction, nested AGENTS.md, skill, truncated-skill, and agent value in both live customizations-index producers.
• Add an explicit v2 format marker and decode only final <file>/<name> scalar values, exactly once, after structural extraction.
• Preserve legacy unmarked index parsing, but fail closed when an unmarked index would otherwise authorize an external read or a direct Skill-tool read.
• Bind the authorization cache to both request ID and index content so a marked-to-unmarked replacement revokes the prior exception.
• Calculate skill truncation budgets from the encoded output.

The format marker is intentional because core and the built-in Copilot extension can update independently. Older unmarked indexes remain usable by non-security consumers, but cannot grant no-confirmation file access.

Validation

• npm run typecheck-client
• npm run transpile-client
• Core computeAutomaticInstructions.test.ts: 64 passed
• npm run eslint
• npm run valid-layers-check
• npm run define-class-fields-check
• Copilot npm run typecheck
• Copilot npm run lint
• Copilot npm run compile
• Copilot focused security suites: 173 passed
• Copilot full npm run test:unit: 9,559 passed, 129 skipped
• Skill-tool Mocha suite: 42 passed
• Copilot npm run test:prompt: 393 passed, 3 pending
• git diff --check