fix: prompt-injection delimiter escape, legacy config coercion, gather resilience, true cross-thread concurrency bound

Addresses items 4-8 from the max-effort review of PR #272 (VectifyAI/PageIndex#272).

- agent.py: wrap_with_doc_context() strips '<'/'>' from doc_name/doc_description
  (untrusted: unsanitized filename / LLM-generated from document content) before
  inserting them into the <docs>...</docs> block, so embedded content can never
  form a literal </docs> that closes the delimiter early and escapes the
  untrusted-data boundary SCOPED_SYSTEM_PROMPT relies on. Deterministic
  per-field transform, doesn't touch the (cacheable) static system prompt.

- ConfigLoader.load() (legacy 0.2.x compat) now routes merged overrides through
  IndexConfig before returning, so a legacy 'no' string gets pydantic's bool
  coercion instead of surviving as a truthy non-empty string — page_index_main's
  bare `if opt.if_add_node_summary:` checks (changed from `== 'yes'` elsewhere
  in this PR) were silently inverting caller intent and firing unwanted billed
  LLM calls.

- verify_toc, process_large_node_recursively, tree_parser,
  generate_summaries_for_structure, generate_summaries_for_structure_md: added
  return_exceptions=True to their asyncio.gather calls (llm_completion/
  llm_acompletion raise RuntimeError on retry exhaustion, added earlier in this
  PR), each with a degrade path matching the pattern already used by sibling
  hardened gathers in the same files. One transient LLM failure no longer
  aborts the whole document's indexing.

- _llm_semaphore is now a true process-wide ceiling (threading.Semaphore,
  shared across every thread/event loop) instead of one asyncio.Semaphore per
  event loop -- concurrently indexing N documents on N threads no longer
  multiplies the effective cap by N. A max_concurrency_scope() override is
  layered as a second, nested, per-loop restriction that can only tighten the
  effective cap within the ceiling, never widen past it.

- set_llm_params() mutated a bare process-wide dict with no per-call isolation,
  unlike max_concurrency which already had ContextVar scoping. Added
  llm_params_scope() (mirrors max_concurrency_scope) + IndexConfig.llm_params,
  wired into build_index() the same way max_concurrency already was, so
  concurrent indexing jobs with different llm kwargs don't leak into each
  other.

Adds regression tests for all five. Full suite: 221 passed, 2 skipped (one
pre-existing, unrelated flaky cloud-streaming test intermittently fails on
rerun; confirmed independent of this change).

Claude-Session: https://claude.ai/code/session_01Kx5DgKbhK1N8autqXH8SmS

tests/test_pipeline.py

@@ -130,6 +130,34 @@ def test_level_based_keeps_text_when_requested():
     assert _structure_has_text(result["structure"])
 
 
+def test_build_index_scopes_llm_params_to_the_call(monkeypatch):
+    """IndexConfig(llm_params=...) must reach get_llm_params() for the duration
+    of this build_index() call only, and not leak into the process default."""
+    from pageindex.config import IndexConfig, get_llm_params, set_llm_params
+
+    set_llm_params(temperature=0)
+    seen = {}
+
+    async def fake_generate_summaries(structure, model=None):
+        seen["llm_params"] = get_llm_params()
+
+    monkeypatch.setattr(
+        "pageindex.index.utils.generate_summaries_for_structure",
+        fake_generate_summaries,
+    )
+
+    # level_based (Markdown) strategy avoids the content_based path's own real
+    # LLM-driven TOC detection, so this stays a fast, network-free unit test.
+    nodes = [ContentNode(content="# Intro\nbody", tokens=5, title="Intro", index=1, level=1)]
+    parsed = ParsedDocument(doc_name="d", nodes=nodes)
+    opt = IndexConfig(if_add_node_summary=True, if_add_doc_description=False,
+                      llm_params={"temperature": 1})
+    build_index(parsed, opt=opt)
+
+    assert seen["llm_params"]["temperature"] == 1   # scoped override was in effect
+    assert get_llm_params()["temperature"] == 0     # process default untouched afterward
+
+
 def test_check_title_appearance_tolerates_out_of_range_physical_index():
     """An LLM-emitted physical_index outside page_list must be marked 'no', not
     raise IndexError (which happens during task construction, outside the