feat: add GOAT strategy with dynamic technique selection for RedTeamAgent

[Aryansharma28]

Summary

• Adds RedTeamAgent.goat() (Python) and redTeamGoat() (JS) implementing Meta's GOAT methodology (ICML 2025) for dynamic per-turn technique selection
• 7-technique catalogue (Hypothetical Framing, Persona Modification, Refusal Suppression, Response Priming, Dual Response, Topic Splitting, Authority & Social Engineering) with 3 soft progress stages instead of Crescendo's fixed phases
• Fixes marathon_script() bug: turns parameter was required with no default — now optional, defaults to total_turns (Python + JS)
• Decouples GOAT metaprompt from Crescendo's _PHASES constants — each strategy uses its own template
• Exports GoatStrategy from the public API (scenario.__init__) alongside CrescendoStrategy

Changes (latest commit)

Python

• GoatStrategy now exported from scenario root (was missing)
• 25 new unit tests: stage boundaries (early/mid/late), prompt building, .goat() factory defaults
• Technique 6 example message was a placeholder — replaced with a complete realistic example

JavaScript

• redTeamGoat() always sets GOAT_METAPROMPT_TEMPLATE — previously fell back to Crescendo's template when attackPlan was supplied
• redTeamGoat() defaults totalTurns to 30 (matches Python)
• metapromptTemplate added to CrescendoConfig so users can override it via both factory APIs
• renderMetapromptTemplate only injects {phase1End} / {phase2End} / {phase3End} when called from the Crescendo path (via new optional phaseEnds param) — GOAT path is clean
• GoatStrategy.getStage() made private (matches Python's _get_stage())
• Float notation 0.3/0.7 → 0.30/0.70 to match Python

Test Results (GOAT vs bank-demo & data-demo agents)

Agent	Held	Broken	Vulnerabilities Found
Bank support (Python)	3/5	2/5	PII leak (email/phone/DOB), customer data leak via social engineering
Data analytics (TypeScript)	4/5	1/5	Agent generates forbidden SQL (pg_read_file, pg_sleep, lo_import)

Test plan

• Run bank-demo red team tests with .goat() strategy (5 attack surfaces)
• Run data-demo red team tests with redTeamGoat() strategy (5 attack surfaces)
• Verify marathon_script() works without explicit turns argument
• Verify GOAT metaprompt generates correctly without Crescendo phase boundaries
• Unit tests for GoatStrategy stage progression (25 tests added)
• GoatStrategy exported from public API
• JS/Python parity: totalTurns default, turns optional, metaprompt template always set

Closes #2143

🤖 Generated with Claude Code

[Aryansharma28]

@copilot resolve the merge conflicts in this pull request

[github-actions]

Automated low-risk assessment

This PR was evaluated against the repository's Low-Risk Pull Requests procedure and does not qualify as low risk.

The PR adds a new GOAT red‑team strategy and changes runtime behavior across both Python and JavaScript (new strategy classes, metaprompt templates, factory functions, and default totalTurns), and it modifies metaprompt rendering and agent orchestration logic. These are behavioral changes to security/attack orchestration code and public APIs rather than purely documentation/tests or trivial formatting, so they do not meet the low‑risk criteria.

This PR requires a manual review before merging.