Prompt injection through user data

An ADR routes refund eligibility to three plain-Java rules the CI can actually assert

The ten-line version they did not build put order and policy into a prompt and parsed a JSON verdict back out. It lost on testability, since the same order can return two answers and CI stays green while behavior drifts.