Finish the D&D audit fixes

internal/modules/dnd/shared/prompt_inputs_test.go

@@ -190,6 +190,47 @@ func TestReferencePromptInputRendering(t *testing.T) {
 	}
 }
 
+func TestReferencePromptInputOrdersRenderedMetadataDeterministically(t *testing.T) {
+	base := contracts.ReferenceItem{
+		SlotName:  "party",
+		MediaType: "text/plain",
+		Content:   []byte("same content"),
+		Digest:    "sha256:same",
+		Origin:    contracts.ReferenceOrigin{Type: "file", URI: "file:///same.txt"},
+		SizeBytes: 12,
+	}
+	tests := []struct {
+		name  string
+		first contracts.ReferenceItem
+		last  contracts.ReferenceItem
+	}{
+		{
+			name:  "origin type",
+			first: referenceItemWithMetadata(base, "archive", "text/plain", 12),
+			last:  referenceItemWithMetadata(base, "file", "text/plain", 12),
+		},
+		{
+			name:  "media type",
+			first: referenceItemWithMetadata(base, "file", "application/json", 12),
+			last:  referenceItemWithMetadata(base, "file", "text/plain", 12),
+		},
+		{
+			name:  "size",
+			first: referenceItemWithMetadata(base, "file", "text/plain", 11),
+			last:  referenceItemWithMetadata(base, "file", "text/plain", 12),
+		},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			forward := ReferencePromptInput(contracts.ResolvedReferenceSlot{Items: []contracts.ReferenceItem{test.first, test.last}})
+			reversed := ReferencePromptInput(contracts.ResolvedReferenceSlot{Items: []contracts.ReferenceItem{test.last, test.first}})
+			if !reflect.DeepEqual(forward, reversed) {
+				t.Fatalf("rendered bytes depend on insertion order:\nforward=%q\nreversed=%q", forward, reversed)
+			}
+		})
+	}
+}
+
 func slotWithContent(name string, content string) contracts.ResolvedReferenceSlot {
 	return contracts.ResolvedReferenceSlot{
 		Slot: contracts.ReferenceSlot{Name: name},
@@ -208,3 +249,10 @@ func referenceItem(slotName, uri, digest, content string) contracts.ReferenceIte
 		Origin:   contracts.ReferenceOrigin{URI: uri},
 	}
 }
+
+func referenceItemWithMetadata(base contracts.ReferenceItem, originType, mediaType string, size int64) contracts.ReferenceItem {
+	base.Origin.Type = originType
+	base.MediaType = mediaType
+	base.SizeBytes = size
+	return base
+}