Fix: support expandable agent prompts (#16)

[tbrandenburg]

Summary

Agent prompts were always rendered through quoted Bash heredocs, preventing workflows from opting into runtime expansion of values captured by earlier vars steps.

Root Cause

AgentStep had no optional expandPrompt field, and render_step() always generated prompt=$(cat <<'PROMPT_EOF', which disables Bash parameter expansion for prompt content.

Changes

File	Change
src/flowsh_cli/models.py	Added strict optional expandPrompt: bool = False to AgentStep.
src/flowsh_cli/render.py	Uses an unquoted prompt heredoc only when expandPrompt is true.
tests/test_workflow_to_harness.py	Added parse, render, and runtime harness coverage for default literal prompts and opted-in expansion.
README.md	Documented default literal prompt behavior and the security-sensitive opt-in warning.

Testing

• Type/compile check passes
• Unit tests pass
• Lint passes
• Runtime harness verification with fake opencode covers expanded and literal prompts

Validation

uv run pytest tests/test_workflow_to_harness.py
uv run ruff check .
uv run python -m compileall src scripts tests
make qa

Issue

Fixes #16

---

Implementation Details

Implementation followed artifact:

.claude/PRPs/issues/issue-16.md

Deviations from plan:

None

---

Automated implementation from investigation artifact

[tbrandenburg]

Automated Code Review

Summary

Reviewed only origin/main...HEAD for issue #16. No findings.

Findings

None.

Strengths

• Root cause is addressed cleanly: agent prompt heredocs remain quoted by default, with explicit expandPrompt: true opt-in for Bash expansion.
• The schema uses strict boolean validation, so "true" is rejected instead of silently coerced.
• Tests cover parsing, rendering, runtime expansion, and default literal behavior.
• README documents the security-sensitive behavior and command-substitution risk.

Security

Default behavior remains safe/literal. Expansion is explicit and documented as security-sensitive. No new unguarded shell execution path is introduced unless expandPrompt: true is deliberately enabled.

Checklist

• Fix addresses root cause from investigation
• Code follows codebase patterns
• Tests cover the change
• No obvious bugs introduced
• make qa passed with 65 passed

---

Self-reviewed by OpenCode. Ready for human review.