fix(placeholders): extract apmInputPrefix constant, consistent double-guard, and complete docs

- Extract apmInputPrefix = "${input:" constant to eliminate literal triplication at lines
  84/112/149 and avoid silent skew if the prefix ever changes
- Apply consistent double-guard (Contains + MatchString) in MaskBodyTokens and
  stripBodyTokens to match ContainsBodyToken, avoiding wasted regex work on malformed
  prefixes like "${input:}" and closing the maintenance trap
- Remove WHAT comments on apmInputRe (CLAUDE.md: comment only when WHY is non-obvious)
- Add "malformed prefix unchanged" test case to drive the Contains guard red/green
- Add apm-input-token to MDS003 and MDS027 rows in opt-in rules table (both rules call
  ContainsBodyToken which handles APMInputToken, so the table omission was misleading)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015Cua8NLiPy6fhj58LvUWf1

Author: claude

docs/background/concepts/placeholder-grammar.md

@@ -74,10 +74,10 @@ from `internal/placeholders`:
 
 | Rule ID | Rule name                        | Useful tokens                                                             |
 | ------- | -------------------------------- | ------------------------------------------------------------------------- |
-| MDS003  | `heading-increment`              | `heading-question`, `placeholder-section`, `var-token`                    |
+| MDS003  | `heading-increment`              | `heading-question`, `placeholder-section`, `var-token`, `apm-input-token` |
 | MDS004  | `first-line-heading`             | `heading-question`, `var-token`, `placeholder-section`, `apm-input-token` |
 | MDS018  | `no-emphasis-as-heading`         | `var-token`, `heading-question`, `placeholder-section`, `apm-input-token` |
 | MDS020  | `required-structure`             | `cue-frontmatter`                                                         |
 | MDS023  | `paragraph-readability`          | `var-token`, `heading-question`, `placeholder-section`, `apm-input-token` |
 | MDS024  | `paragraph-structure`            | `var-token`, `heading-question`, `placeholder-section`, `apm-input-token` |
-| MDS027  | `cross-file-reference-integrity` | `var-token`, `heading-question`, `placeholder-section`                    |
+| MDS027  | `cross-file-reference-integrity` | `var-token`, `heading-question`, `placeholder-section`, `apm-input-token` |

internal/placeholders/placeholders.go

@@ -23,8 +23,9 @@ import (
 	"github.com/jeduden/mdsmith/internal/fieldinterp"
 )
 
-// apmInputRe matches APM ${input:NAME} prompt parameters.
-// NAME must start with a letter and contain only letters, digits, underscores, and hyphens.
+// apmInputPrefix is the byte sequence that uniquely opens an APM input parameter.
+const apmInputPrefix = "${input:"
+
 var apmInputRe = regexp.MustCompile(`\$\{input:[A-Za-z][\w-]{0,63}\}`)
 
 // Named placeholder tokens.
@@ -81,7 +82,7 @@ func ContainsBodyToken(text string, tokens []string) bool {
 				return true
 			}
 		case APMInputToken:
-			if strings.Contains(text, "${input:") && apmInputRe.MatchString(text) {
+			if strings.Contains(text, apmInputPrefix) && apmInputRe.MatchString(text) {
 				return true
 			}
 		}
@@ -109,7 +110,7 @@ func MaskBodyTokens(text string, tokens []string) string {
 				return neutralText[PlaceholderSection]
 			}
 		case APMInputToken:
-			if strings.Contains(text, "${input:") {
+			if strings.Contains(text, apmInputPrefix) && apmInputRe.MatchString(text) {
 				text = apmInputRe.ReplaceAllLiteralString(text, neutralText[APMInputToken])
 			}
 		}
@@ -146,7 +147,7 @@ func stripBodyTokens(text string, tokens []string) string {
 				return ""
 			}
 		case APMInputToken:
-			if strings.Contains(text, "${input:") {
+			if strings.Contains(text, apmInputPrefix) && apmInputRe.MatchString(text) {
 				text = apmInputRe.ReplaceAllLiteralString(text, "")
 			}
 		}

internal/placeholders/placeholders_test.go

@@ -335,6 +335,7 @@ func TestAPMInputToken_MaskBodyTokens(t *testing.T) {
 		{"single token replaced", "${input:pr_url}", "word"},
 		{"token in sentence", "review ${input:pr_url} now", "review word now"},
 		{"two tokens replaced", "${input:a} and ${input:b}", "word and word"},
+		{"malformed prefix unchanged", "${input:}", "${input:}"},
 		{"non-matching unchanged", "${output:x}", "${output:x}"},
 		{"plain text unchanged", "some prose", "some prose"},
 	}