Fix/guard decoupling and detection corpus - #1

Two issues reported after the guard-decoupling work.

Parser: v0.8.0 classified any mention of an operative verb as operative, so
"What does rm -rf do?" became an operative request with no declared tool. That
scores 55 at the ExecutionGate — above the operative confirm_at of 50 — so
every question about a command returned `escalate`. A narrow meta-question
frame (what does/is/are, how does X work, explain/describe/define; anchored at
the start, third person only) now keeps such inputs consultive.

The frame is disqualified by any clause separator, by an explicit tool: or
mode:operative, and does not match first-person how-to phrasing, so the pinned
v0.8.0 cases are unchanged. It is an ergonomics fix, not a security boundary:
ProceduralGuard matches raw input regardless of intent and IntentEscalation
raises the request back to operate, so "explain rm -rf /" is still hard-denied.
Covered by test_meta_question_frame_is_not_a_bypass.

pre_api_gate: the shadow_timeout scenario compared absolute subprocess wall
time against fixed budgets, measuring interpreter startup and package imports
rather than what it asserts — that the shadow adds bounded latency and that
--no-wait-shadow adds none. On a host where importing aetherya.cli alone costs
130ms the 150ms budget was unreachable regardless of engine behaviour. Budgets
now apply to overhead over a shadow-disabled baseline, and the wait path also
excludes the measured provider-SDK import. Overhead is 26ms (no-wait) and 291ms
(wait, against a configured 100ms timeout) versus 157ms and 733ms of wall time.

pre_api_gate now passes all three scenarios. 891 tests, 100% coverage, mypy
strict and ruff clean, benchmarks and security_baseline unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Six items making the engine deployable rather than only correct in-process.

Adversarial sweep. 26 systematic evasions run against the new procedural
corpus; 4 got through and 5 more were downgraded from hard_deny to escalate by
quoting. Closed: r''m -rf / (quote-split command name, previously ALLOWED
outright), truncate/tee to a block device, and python -c shutil.rmtree('/').
The same evasion class also worked against the JailbreakGuard —
"ign''ore previous instructions" was undetected — so quote and escape stripping
moved into the shared normalizer, which is the property text_normalize exists
to guarantee. The corpus is pinned as a regression fixture with per-case
expectations, and cases only resolvable at execution time (variable expansion,
pipe contents, base64) are asserted to reach the confirmation band rather than
hard-deny, with the limits documented.

Parser. Parameter and target values are no longer lowercased. Values were read
from a lowercased copy, so param.path=/tmp/MyFile.TXT was audited as
/tmp/myfile.txt — a different file on any case-sensitive filesystem, meaning
the audit trail did not describe the action that was authorised.

Structured input. run_pipeline_structured() and an `action` object on
POST /v1/decide take a fully-formed ActionRequest, skipping the heuristic
parser so no part of the decision depends on inferring structure from free
text. Every other stage is unchanged: structured callers still pass the ABI
contract and IntentEscalation, so declaring intent="ask" on a destructive
payload bypasses nothing.

Distributed rate limiting. The in-process limiter meant that behind N workers
the effective limit was N x requests_per_window — the configured limit simply
was not the limit that applied. RedisActorRateLimiter shares the window via a
sorted set per actor with the drop/count/add/expire sequence in one pipeline.
Fails closed: an unreachable Redis refuses the request rather than going
silently unlimited.

Policy version contract. AETHERYA_EXPECTED_POLICY_FINGERPRINT pins the policy a
process may load; a mismatch fails at load. Two replicas on different policies
diverge on identical input and nothing surfaces that until someone diffs audit
trails — pinning turns silent divergence into a startup failure.

Semantic readiness. The advisory layer declines to run on a cold model, making
it a silent no-op wherever nothing warmed it. /health now reports
semantic_ready and degraded; the server preloads before accepting traffic, and
--require-semantic-ready fails startup instead of serving degraded.

Audit retention. AuditLogger gains fsync and an AuditSink mirror fan-out for
append-only storage. Mirrors get the byte-identical primary line so the chain
verifies the same on either copy; failures increment mirror_errors rather than
taking the decision path down.

Verification: 985 tests, 100% coverage, mypy strict and ruff clean.
pipeline_benchmark p95 0.27ms, chaos p95 1.45ms detection 1.0,
security_baseline 0 differences, pre_api_gate ok=True.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>