test(instructions): verify personal persistence and actor isolation

[akemmanuel]

Summary

Refs #155. Test-only verification, not a claim that the reported deployed incident has been fixed or reproduced.

Current master already implements persistent Host/Project/Personal instructions. The local two-Account tests passed without implementation changes, so this PR adds missing regression coverage rather than a second instruction store or speculative fix.

• Exercise authenticated Personal CRUD, ID spoofing isolation, oversized-input preservation, and API-key endpoint denial.
• Capture actual Harness ModelRequest.systemPrompt for alternating actors on the same Session and an API-key turn; Personal text follows the requesting actor, not the Session creator, and is not inherited by API keys.
• Verify concurrent Account saves and restart persistence.
• Verify failed Personal saves preserve the editor draft and leave retry available.

The same-Session context test uses the Host/Harness actor seam directly; it is not a browser/deployed restricted-Account authorization test. Existing tests cover instruction composition, queued actors, Project permissions, and scope copy.

Verification

Independently rerun by the parent:

• vp test packages/backend/src/host/opengui-host.instructions.test.ts packages/backend/src/identity/project-instructions.integration.test.ts packages/backend/src/identity/personal-instructions.verification.test.ts src/features/instructions/InstructionsSettings.render.test.tsx --maxWorkers=2 — 14 passed.
• vp check — pass.
• pnpm run slop-check — pass.
• git diff --check — pass.

All markers and Accounts are harmless local fixtures; no customer instructions or production data were used.

Remaining acceptance

#155 remains open pending actual deployed revision/configuration parity and reproduction. Long-Session manual/threshold compaction is coordinated with #150/#151 and is not claimed by these tests. Local browser acceptance scripts currently fail on stale UI selectors (New session / Host account); those runs are not evidence that this acceptance is satisfied. No scope, permission, UI text, or persistence contract changed.