fix(c01): stop injection false positives on placeholders, format examples, and zero-width doc artifacts (litmus-v13)

[RubenSousaDinis]

What

The C-01 tool-output-injection scanner floored several honest MCP servers on benign structures rather than genuine hijacks. This tightens the detector so those cases pass while keeping true-positive detection intact, and bumps the methodology to litmus-v13.

False positives fixed

Pattern	Example	Was	Now
Angle-bracket placeholder in usage text	call_tool({ name: "<tool>" })	F	A
Pipe-separated CLI placeholder	target=<system | client | /group/>	F	A
XML data example	<user><name>John</name>...	F	A
data: format description	data:image/...;base64,..., data:{jsx:...}	F	A
Field label	New system prompt (schema description)	F	A
Zero-width char in relayed docs	U+200B bracketing an inline-code span	F	A

How

• Role tags: strong <system>/<assistant> tags exclude | (a pipe placeholder isn't a role tag); weak <user>/<tool> tags must wrap a word character to count as an injected block.
• data: URIs: flag only a real type/subtype mediatype URI, not a data:-prefixed description. data:text/html, SVG, and every javascript: URI still flag.
• "new/updated system prompt": floors only as a colon-introduced directive (New instructions: ...), not as a bare field label.
• Zero-width chars → normalize-then-scan (the important one): a zero-width code point is graded MEDIUM (recorded as evidence, not an automatic floor), because on its own it carries no instruction and is rampant as a benign documentation artifact. Keyword-evasion stays covered because the injection scanners now strip invisible code points before matching — so a zero-width-split keyword (ins<U+200B>tructions) de-obfuscates and still fails HIGH. Bidi/override and Unicode tag characters remain HIGH. Skill grading keeps every invisible char at the fail bar.

Methodology

Bumps METHODOLOGY_VERSION to litmus-v13 — a genuine C-01 pass/fail-semantics change. The field stays a string so older attestations coexist.

Verification

• Full probes suite green (413 passed). The evil / injecting / second-order demo fixtures still grade F — true-positive detection is unchanged.
• Seven real servers that previously mis-graded F now grade A under litmus-v13: @jshookmcp/jshook, @liangshanli/mcp-server-apidebug, ai-diagram-maker-mcp, arc-1, genable-mcp, mcp-vapi, pinescript-mcp-server.