detectors: ground AgentBreaker judge in the victim's tool contract

[koralchapnik]

The AgentBreakerResult judge previously decided "was this a violation?" using only the attacker's vulnerability_info hypothesis. That lets the attacker's framing define success and inflates false positives when the agent merely used a tool exactly as its contract allows.

Feed the victim agent's own tool contract into the judge instead:

• probe: AttackState carries agent_purpose + the target tool's declared description; both are stashed into attempt.notes (from agent.yaml, or from the probe's auto-discovery when the yaml omits them) and passed to the in-loop verify().
• detector: verify() / _evaluate_single_output() accept agent_purpose and tool_description (defaulted, so existing keyword callers are unaffected); detect()'s fallback path reads them from notes. Verdicts now also carry a block_label, so verify() returns a 4-tuple and per-output verified_results entries are 3-tuples.
• prompts.yaml: the VERIFY template now judges against (A) the tool's contract and (B) universal security harms, with an explicit decision order and richer verdict fields (violation_basis, verdict_reason).

Contract-grounding is the default; the fast path (probe-computed verified_results) is unchanged.

Adds detector tests for contract rendering, missing-contract fallbacks, back-compat, richer-field tolerance, and a packaged-prompt guard, plus probe tests for AttackState round-trip and contract capture.

Verification

• garak -t <target_type> -n <model_name> — ran the probe end-to-end against a live agent target; the contract-grounded judge fires and scores per-output verdicts
• python -m pytest tests/detectors/test_detectors_agent_breaker.py tests/probes/test_agent_breaker.py — 83 passed
• Validated against a real internal agent target to assess AgentBreaker performance

[jmartin-tech]

Validation testing against a mock agent produced viable results. This may impact or subsume some of the changes in #2044 and #2069.

A note on testing, upstream dependency issues will cause a CI/CD failure until this is merged or rebased on commit 3845757 or newer from main.

Testing to enable a consolidated merge with the noted PRs is in progress.

[koralchapnik]

Thanks for the thorough validation, @jmartin-tech — glad the mock-agent results looked viable.

I've rebased onto 3845757 (the anthropic pin), so the upstream dependency failure should be cleared. The workflow runs are currently pending maintainer approval — could you kick those off when you get a chance?

Happy to help with the consolidation against #2044 and #2069 — let me know if you'd like me to adjust anything here to make that merge cleaner.