Align the forged-marker guard test with the N6 semantics

Why: Stop.Replacement no longer rewrites the in-memory assistant; the
correction reaches the model as a user note. The guard's protective
intent is unchanged (forged body never replays as assistant speech).
Evidence: go test -count=1 ./... green.
Impact: test only.
Refs: Agent-Native#30, N3 plan WP1

internal/runtime/llm_test.go

@@ -784,7 +784,8 @@ func TestLLMRunnerForgedToolMarkerTriggersGuard(t *testing.T) {
 	if calls != 2 {
 		t.Fatalf("stream calls = %d, want 2", calls)
 	}
-	var placeholder bool
+	// N6（N3 WP1）：伪造正文不得作为 assistant 的话术回放；更正以 user
+	// 消息出现（不再改写 assistant）。
 	for _, m := range replay {
 		if m.Role != agentllm.RoleAssistant {
 			continue
@@ -792,12 +793,15 @@ func TestLLMRunnerForgedToolMarkerTriggersGuard(t *testing.T) {
 		if strings.Contains(m.Content, "run_python") {
 			t.Fatalf("forged body was replayed: %q", m.Content)
 		}
-		if strings.Contains(m.Content, "已作废") {
-			placeholder = true
+	}
+	var correction bool
+	for _, m := range replay {
+		if m.Role == agentllm.RoleUser && strings.Contains(m.Content, "已作废") {
+			correction = true
 		}
 	}
-	if !placeholder {
-		t.Fatalf("correction replay missing placeholder, got %#v", replay)
+	if !correction {
+		t.Fatalf("correction replay missing user note, got %#v", replay)
 	}
 	texts := textParts(rc.assistant)
 	if len(texts) != 2 || !texts[0].Process || texts[1].Process {