feat(prompts): revamp preset prompts, tool naming, and prompt templating

Rewrite the default/creative/strict presets (classic + agentic) into
structured sections: grounding and cite-by-title guidance, insufficient-
context behavior, current date, respond-in-user-language, scoped mermaid
usage, an untrusted-content guardrail, and a conditional XML-tagged
document context block. A memory directory listing is injected at render
time via the template prefetch mechanism so the model starts oriented
without burning a tool call.

Fixes along the way:
- Agentic preset swap was dead code: _get_prompt_content cached the
  classic preset before create_agent's swap check ran, so agentic and
  research agents always got the classic preset. The swap now happens
  inside _get_prompt_content.
- Jinja autoescape corrupted document content in custom prompts
  (< -> &lt;); prompts are not HTML, autoescape is now off.
- Literal {summaries} leaked into the prompt when no docs were
  retrieved; the placeholder is now stripped.
- Agentic/research prompts referenced tool names from a dropped naming
  scheme (search_internal, reason_think); they now reference the real
  names (search, reason).
- The strict preset told the model to "be very creative and use your
  imagination" right after "never make up information".
- extract_tool_usages recorded intermediate attribute chains as
  bare-tool usages, which meant "run all actions" at prefetch; only
  maximal chains are recorded now.
- Headless runs retrieved docs but never rendered them into the
  prompt; the prompt is now rendered like the streaming path.
- Default tools were unreachable by name in prompt templates
  (prefetch results were keyed by synthetic id only); defaults now
  claim the name key unless an explicit row shadows it.

Tool layer: memory/notes/todo actions are namespaced (memory_view,
note_overwrite, todo_create, ...) with legacy unprefixed names still
accepted via prefix stripping; duplicate action names across tools are
disambiguated with the owning tool's name instead of numeric suffixes;
thin tool descriptions rewritten (brave, duckduckgo, telegram, ntfy,
cryptoprice, read_webpage, internal_search, think).

Docs are now wrapped per chunk in <document index>/<source>/<content>
tags for citation-by-title support.

tests/test_template_engine.py

@@ -55,10 +55,13 @@ class TestRender:
         result = engine.render("{{ missing }}", {})
         assert result == ""
 
-    def test_autoescape_html(self, engine):
-        result = engine.render("{{ content }}", {"content": "<script>alert(1)</script>"})
-        assert "<script>" not in result
-        assert "&lt;script&gt;" in result
+    def test_no_autoescape_content_preserved(self, engine):
+        # Output is an LLM prompt, not HTML: injected values (e.g. document
+        # content with markup or code) must pass through verbatim.
+        result = engine.render(
+            "{{ content }}", {"content": "<code>a < b && c == 'd'</code>"}
+        )
+        assert result == "<code>a < b && c == 'd'</code>"
 
     def test_trim_blocks(self, engine):
         tpl = "{% if True %}\nyes\n{% endif %}"
@@ -184,3 +187,15 @@ class TestExtractToolUsages:
         result = engine.extract_tool_usages(tpl)
         assert "search" in result
         assert "results" in result["search"]
+
+    def test_full_chain_does_not_record_bare_tool(self, engine):
+        # The intermediate ``tools.memory`` node must not register as a
+        # bare-tool usage (None = "run all actions") when the template
+        # only references one specific action.
+        tpl = (
+            "{% if tools.memory.memory_view %}"
+            "{{ tools.memory.memory_view }}"
+            "{% endif %}"
+        )
+        result = engine.extract_tool_usages(tpl)
+        assert result == {"memory": {"memory_view"}}