feat(attack-sim): attack-simulation benchmark harness (Phase A)

[rennf93]

What this adds

A self-contained attack-simulation benchmark under tests/attack_simulation/ (not shipped in the wheel) that measures the regex/detection layer with numbers:

• Hybrid corpus — project-authored seed payloads (8 attack classes) + a deterministic mutation engine (12 evasion transforms + curated chains) + a benign corpus that probes false positives.
• Drives the real SusPatternsManager.detect() through a production-shaped SecurityConfig (normalization active), via a singleton-safe context manager.
• Metrics: detection rate, false-positive rate, F-score, per-attack-class recall, per-technique evasion-resistance matrix, and per-benign-category FP breakdown.
• Two faces: make attack-sim emits report.json + report.md; a committed baseline.json + test_attack_simulation.py enforce no-regression (ratchet, not absolute thresholds).

How to run

make attack-sim                      # human + machine report into tests/attack_simulation/out/
uv run pytest tests/attack_simulation/   # 16 tests incl. the ratchet gate

Baseline this run records

detection 0.658 · FP 0.125 · F 0.791 · 4.64s / 320 scans.

The first run already surfaced real findings (this is the point — the harness measures, it does not fix):

• Coverage holes (false negatives): SSTI {{7*7}}/${7*7} → 0.0, NoSQL {"$gt":""} → 0.0, boolean SQLi 1' OR '1'='1 → 0.5. These canonical payloads are not detected.
• Chained-evasion bypass: unicode_homograph + url_encode collapses recall 0.688 → 0.188 (a normalization-order gap).
• False positives concentrate in prose_sql_keywords (0.667) — SELECT…FROM in natural language; every other benign category is 0.0.

These become the measured, prioritized worklist for the next phase.

Scope / safety

Test-only additions plus an additive Makefile target and one .gitignore line. No shipped guard_core/ code changed.

Note: the pre-existing sync-mirror --check may report red on CI; it is unrelated to this change (the harness is test-only and does not touch the unasync sync mirror).