[security] Safe-prefix cache skips injection spanning the prefix boundary #82

Problem

The default safe-prefix cache marks a verified-clean prefix, then on append-only growth scans suffix only with no overlap. An injection phrase split across the prefix boundary (e.g. prefix "Please ignore pre" then append the remainder) can evade detection even though a full re-scan (cache off) correctly blocks.

Expected / acceptance criteria

• Safe-prefix reuse re-scans an overlap window at the boundary (same philosophy as StreamScanner), or safe-prefix caching is disabled by default until that exists
• Fail-closed: never allow a split pattern that full-document scan would block
• Regression test: cache-on append that splits a known injection phrase must BLOCK (or equivalent deny) matching cache-off behavior

Notes

Repro sketch (cache enabled, shared document_id):

1. Scan "Please ignore pre" → allow / advance prefix
2. Scan same text + remainder of injection phrase → must block like cache disabled

Related: chunk/prefix cache keys currently ignore source and policy (separate issue if not fixed together).