feat(evaluators): add ATR threat detection evaluator

[eeee2345]

Summary

Add a contrib evaluator using ATR (Agent Threat Rules) for regex-based AI agent threat detection. No API keys required.

Resolves #169

Evaluator details

• Name: atr.threat_rules
• Auto-discovery: via agent_control.evaluators entry point
• Config: ATRConfig with min_severity, categories, block_on_match, on_error
• Rules: 20 ATR rules, 306 compiled patterns across 8 categories
• Performance: <5ms evaluation, pure regex

Config options

ATRConfig(
    min_severity="medium",       # Filter rules below this severity
    categories=["prompt-injection"],  # Only load specific categories (empty = all)
    block_on_match=True,         # Set matched=True on detection
    on_error="allow",            # "allow" (fail-open) or "deny" (fail-closed)
)

Key design decisions

• Multi-match: Returns ALL matching rules, not just first match. Metadata includes findings array + backward-compatible single-match fields.
• _coerce_to_string: Scans all priority dict fields (content, input, output, text, message), not just the first.
• Error handling: Respects on_error policy — fail-open returns error field, fail-closed returns matched=True.
• Follows Cisco evaluator pattern: Same directory structure, pyproject.toml, Makefile, entry points.

Files

evaluators/contrib/atr/
  pyproject.toml              # hatchling build, entry point
  Makefile                    # test/lint/typecheck/build
  README.md                   # Usage docs
  src/.../threat_rules/
    config.py                 # ATRConfig
    evaluator.py              # ATREvaluator (222 lines)
    rules.json                # 20 rules, 306 patterns
  tests/
    test_evaluator.py         # 22 tests

Test plan

• Rule loading and compilation
• Known-bad inputs: prompt injection, jailbreak, reverse shell, credential exposure, system prompt override
• Known-good inputs: normal text, code, URLs
• Config: min_severity filtering, category filtering, block_on_match=False
• Error handling: None/empty input, on_error deny/allow
• Multi-match: content triggering multiple categories returns all findings
• Dict input: scans all priority fields
• make test / make lint / make typecheck