feat: Improve output readability and separate trusted system variables from injectable inputs

[dhl123]

Sumamry

1. The generated artifacts are hard to read
2. Trusted system variables are conflated with injectable arguments

When running step A/B, we get response like the following:

Confirmed: none of queries_this_session, user_role, dissertation_area, research_area, user_name appear anywhere in agent.py, server.py, or app.py. These subject/session fields exist only in system_vars.json — they're never read, validated, or enforced by any layer of the actual code. This is exactly the kind of self-reported, code-side-invisible data that OPA would need to intercept at the boundary (input.extensions.subject.*) since the agent layer does nothing with them itself (note: agent.py's build_system_prompt does inject user_profile — i.e. whatever the caller passes as req.user_profile — into the system prompt as free text, but that's a prompt-injection surface, not enforcement).

System variables are trusted — they're supplied by the runtime as subject data and are the authoritative source, nit prompt injectable. We need to separate analysis of system variables and tool args when analyze.