Prompt injection is not fixed by better prompts. The attack surface lives in the tool layer. Here is what actually closes it.