feat(builder): bounded model requests, a safety check, and a clearer PR summary

- The drafter no longer grows one conversation. Each request is the rules
  and facts, the model's latest template, what is wrong now and one line per
  earlier round, so long builds can't push the facts out of the model's
  32K context (Ollama drops the oldest part silently). The image's scripts
  in the facts are capped at 24000 characters in all, and diagnosis check
  results at 16000.
- Every model call logs its prompt and answer tokens, with a warning near
  the context limit.
- unsafeCommands: a draft whose startup command or installConfig pipes a
  download into a shell, decodes base64, uses eval, raw network tools or
  /dev/tcp, sudo/su, setuid bits, writes /etc, touches cron/systemd/firewall,
  or looks like a miner goes back to the model. AUTHORING.md has the rule.
- The PR summary lists every address nodes would download from under
  "Review carefully", marks the measured checks as measured, and labels the
  research notes as the model's reading, not checked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

cmd/gbrgames/build.go

@@ -406,11 +406,20 @@ func buildSummary(o buildOptions, res *buildResult) string {
 	}
 	fmt.Fprintf(&b, "\n- Model rounds: %d\n", res.Rounds)
 	if len(res.Verified) > 0 {
-		b.WriteString("\n**Checked for real**\n")
+		b.WriteString("\n**Checked for real** (measured by the builder, not the model's word)\n")
 		for _, v := range res.Verified {
 			fmt.Fprintf(&b, "- %s\n", v)
 		}
 	}
+	// What a node will fetch from the internet for this game: the part of a template a reviewer must check
+	if g, err := loadMap(filepath.Join(res.Dir, "game.yaml")); err == nil {
+		if urls := downloadURLs(g); len(urls) > 0 {
+			b.WriteString("\n**Review carefully: nodes download from these addresses**\n")
+			for _, u := range urls {
+				fmt.Fprintf(&b, "- %s\n", u)
+			}
+		}
+	}
 	if len(res.Problems) > 0 {
 		b.WriteString("\n**Still open** (the builder could not fix these)\n")
 		for _, p := range res.Problems {
@@ -424,7 +433,7 @@ func buildSummary(o buildOptions, res *buildResult) string {
 		}
 	}
 	if o.variant.Notes != "" {
-		fmt.Fprintf(&b, "\n**Notes from research:** %s\n", o.variant.Notes)
+		fmt.Fprintf(&b, "\n**From the sources** (the model's reading of the pages below, not checked): %s\n", o.variant.Notes)
 	}
 	if len(o.variant.Sources) > 0 {
 		b.WriteString("\n**Sources**\n")