chore: keep untrusted-output boundary off until isolated smoke test

Revert the four UntrustedOutputBoundary: true lines. The bump to Norma
v0.4.6 stays; the boundary is available there but remains disabled until
an isolated smoke run is done (no throwaway database, cheap profile or
test key yet).

agent/chat.go

@@ -160,9 +160,6 @@ func (c *ChatAgent) Chat(ctx context.Context, agentKey, sessionID, message strin
 		Settlement:   wrapupSettlement(agentKey, nil),
 		NonStreaming: c.nonStreaming(), // when this profile selects non-streaming, use Provider.Complete
 		MaxTokens:    c.maxTokens(),    // 0 = send no cap, the server's default decides
-
-		// Frame tool results as untrusted data (nonce-tagged); see harness/untrusted.go.
-		UntrustedOutputBoundary: true,
 	}
 	if c.guard != nil {
 		opts.Hooks = c.guard.Hooks()

agent/mainagent.go

@@ -169,9 +169,6 @@ func (m *MainAgent) Chat(ctx context.Context, taskID int64, mainSeg int, as *db.
 		Settlement:   wrapupSettlement("mainagent", nil),
 		NonStreaming: m.nonStreaming(), // when this profile selects non-streaming, use Provider.Complete
 		MaxTokens:    m.maxTokens(),    // 0 = send no cap, the server's default decides
-
-		// Frame tool results as untrusted data (nonce-tagged); see harness/untrusted.go.
-		UntrustedOutputBoundary: true,
 	}
 	if m.tx != nil { // persist raw human↔AI conversation; one accumulating file per segment
 		opts.Transcript = m.tx

agent/planner.go

@@ -457,9 +457,6 @@ func (p *Planner) Plan(ctx context.Context, taskID int64, as *db.AssetStore, ts
 		Settlement:   settle,
 		NonStreaming: p.nonStreaming(), // when this profile selects non-streaming, use Provider.Complete
 		MaxTokens:    p.maxTokens(),    // 0 = send no cap; the server default decides
-
-		// Frame tool results as untrusted data (nonce-tagged); see harness/untrusted.go.
-		UntrustedOutputBoundary: true,
 	}
 	if p.tx != nil { // persist raw LLM conversation; one accumulating file per task's planner
 		opts.Transcript = p.tx

agent/worker.go

@@ -526,9 +526,6 @@ func (w *Worker) execute(ctx context.Context, name string, taskID int64, as *db.
 		Todos:         actool.NewTodoStore(),                  // session-level scratch todos (TodoWrite), pure planning, discarded on exit
 		NonStreaming:  w.nonStreaming(),                       // when this profile selects non-streaming, use Provider.Complete
 		MaxTokens:     w.maxTokens(),                          // 0 = send no cap; the server default decides
-
-		// Frame tool results as untrusted data (nonce-tagged); see harness/untrusted.go.
-		UntrustedOutputBoundary: true,
 	}
 	if hooks != nil { // typed-nil guard: only set when concrete (avoids harness panic)
 		opts.Hooks = hooks