#11921: feat(hooks): support systemPrompt injection in before_agent_start hook

## Summary - Allow `before_agent_start` hooks to return a `systemPrompt` field that gets injected into the agent's system prompt, in addition to the existing `prependContext` field - System prompt patches are wrapped in XML tags and idempotently replaced each turn — no accumulation across compaction boundaries - Both `prependContext` (8K chars) and `systemPrompt` (4K chars) are size-capped to prevent hooks from bloating context ## Motivation Plugins can already inject context into user messages via `prependContext`, but some use cases (mission directives, persistent constraints, role instructions) belong in the system prompt where they carry higher authority and don't duplicate across message history. Unlike `prependContext` which accumulates in every turn's user message until compaction, system prompt content exists once and is rebuilt fresh each turn. ## Test plan - [x] `pnpm build` passes - [x] All 158 tests in `src/agents/pi-embedded-runner/` pass - [x] Existing `prependContext` behavior preserved (with added size cap) - [ ] Manual: verify plugin returning `systemPrompt` from `before_agent_start` hook injects into system prompt 🤖 Generated with [Claude Code](https://claude.com/claude-code) <!-- greptile_comment --> <h2>Greptile Overview</h2> <h3>Greptile Summary</h3> This PR extends the `before_agent_start` hook handling in `src/agents/pi-embedded-runner/run/attempt.ts` to support an additional `systemPrompt` return field alongside the existing `prependContext`. It introduces size caps for both hook-provided strings and wraps `systemPrompt` patches in an XML-tagged block that is intended to be replaced idempotently (by stripping any prior patch block before re-appending). Overall, the change fits into the embedded runner’s pre-prompt phase: hooks can now modify the effective user prompt and/or override the agent session’s system prompt before `activeSession.prompt(...)` is invoked. <h3>Confidence Score: 3/5</h3> - This PR is mostly safe to merge, but has a couple of correctness/robustness issues around system-prompt patching semantics that should be addressed first. - The core flow (cap + apply override) is straightforward, but the patch stripping approach can delete unintended content if the payload contains the chosen delimiters, and internal run tracking can diverge from the actual system prompt used after patching. - src/agents/pi-embedded-runner/run/attempt.ts <!-- greptile_other_comments_section --> _{(2/5) Greptile learns from your feedback when you react with thumbs up/down!} <!-- /greptile_comment -->