fix(security): reject non-UTF-8 responses and fix injection tracking

[imran-siddique]

Summary

• Closes HIGH: injection stage audit label overwrites AGT MCPResponseScanner result — misleading audit trail (POLICY-006) #154 (POLICY-006): AGT MCPResponseScanner deny no longer overwritten by regex-stage allow
• Closes HIGH: injection_detected flag ignores AGT MCPResponseScanner detections — InjectionEvent not recorded (INJECT-004) #155 (INJECT-004): injection_detected now reflects both scanners; session always records InjectionEvent when either fires
• Closes HIGH: Response decoded with errors='replace' before injection scanning — bypass via invalid UTF-8 (INJECT-005) #156 (INJECT-005): non-UTF-8 responses rejected before injection scanning; errors="replace" would corrupt byte sequences an attacker could exploit to bypass pattern matching

Test plan

• test_pipeline_denies_non_utf8_response — non-UTF-8 payload → deny with non-utf8-response pattern
• test_pipeline_non_utf8_calls_session_update_with_injection_detected — injection_detected=True on non-UTF-8 path
• test_agt_mcp_scanner_deny_sets_injection_detected_on_session — AGT MCP scanner deny sets injection_detected=True on session
• test_agt_mcp_scanner_deny_is_not_overwritten_by_regex_allow — final decision is "deny" even when regex stage returns "allow"
• All 232 tests pass

🤖 Generated with Claude Code