Mentions: @handle forwards whole message externally; @-menu inserts internal text (PR #2 review) #13

Context

Any @handle typed in a user message forwards the whole message to a remote Bot. The social @ menu also inserts internal instruction text into the message. This was flagged in the PR #2 review (item 14) and in a Codex inline comment, and is still present at 7b806c6.

Original feedback

• @hsliuustc0106 review (permalink), item 14: "any @handle anywhere in a user message (including code spans, quotes, pasted transcripts …) sends the entire message text externally … The social client's @ rows make it worse by inserting (remote Bot: use message_friend_bot) into the message text."
• Codex inline comment, Insert only the handle in social mention rows (permalink), ds-bot/plugins/social/client.js L235 (P2).

Where (at 7b806c6)

• plugins/social/client.js#L235: value: `${friend.handle} (remote Bot: use message_friend_bot) `
• src/host/hooks.js#L440-L475: the user-mention listener

Proposed fix

• Insert only @handle from the menu row.
• Reuse the base repo's mention parser, which excludes code spans, fenced code and quotes. Consider forwarding only explicit mentions selected from the menu.

Acceptance criteria

• Selecting a Friends' Bots row inserts only the handle.
• @bob.home inside a code span or quote triggers no external send.
• The remote Bot never receives the (remote Bot: …) text, and the local Bot does not send a second copy.

Refs: PR #2 (merged), umbrella #3. Verified against Birfy/FlyBot flybot-plugins tip 7b806c6.