test: W1.1 eval locates the adversarial prompt by its body, not the boundary wording (W1.1)

The before panel's prompt bytes are unchanged; a rewording of the boundary no
longer breaks the locator, and a prompt that lost its boundary prefix fails
loudly instead of running an unbounded arm.

test/skill-e2e-safety-codex-boundary.test.ts

@@ -63,10 +63,11 @@ while True:
 /** The rendered /review adversarial prompt, as the skill hands it to Codex. */
 function adversarialPrompt(arm: 'rule' | 'removed'): string {
   const section = fs.readFileSync(path.join(ROOT, 'review', 'sections', 'adversarial.md'), 'utf8');
-  const line = section.split('\n').find(l => l.startsWith('"IMPORTANT:') && l.includes('Review the changes on this branch against the base branch'));
+  const line = section.split('\n').find(l => l.startsWith('"') && l.includes('Review the changes on this branch against the base branch'));
   if (!line) throw new Error(`${CASE}: the adversarial outside prompt is missing from review/sections/adversarial.md`);
   const prompt = line.slice(1, line.lastIndexOf('"')).replaceAll('\\n', '\n').replaceAll('<base>', 'main');
   const body = prompt.indexOf('Review the changes on this branch');
+  if (body <= 0) throw new Error(`${CASE}: the adversarial outside prompt no longer starts with the filesystem boundary`);
   return arm === 'rule' ? prompt : prompt.slice(body);
 }