Summary

Implements three complementary IPI defense enhancements from research issues #2193, #2208, #2335:

• research(security): MELON paper — DeBERTa injection detectors have high FPR; use as soft signal only (arXiv:2502.05174) #2193 (MELON): InjectionEnforcementMode (Warn/Block) — default Warn returns Suspicious instead of Blocked, preventing high DeBERTa FPR from blocking legitimate tool operations. All fallback paths (regex, error, timeout) respect the mode via regex_verdict() helper.
• research(security): AlignSentinel — alignment-aware DeBERTa-v3 classifier reduces FPR on benign tool outputs (arXiv:2602.13597) #2208 (AlignSentinel): CandleThreeClassClassifier two-stage pipeline — binary detection first, three-class refinement (misaligned/aligned/no-instruction) on positive hits. Aligned instructions downgraded to Clean. Dynamic id2label from model config.json; load failures allow retry.
• research(security): AgentSentry temporal causal diagnostics — turn-level IPI attribution + context purification, +20-33pp utility under attack (arXiv:2602.22724) #2335 (AgentSentry): TurnCausalAnalyzer — per-batch LLM probes at tool-return boundaries, local Levenshtein+Jaccard deviation scoring. Never blocks; emits ipi.causal_deviation metric + SecurityEvent on threshold crossing. Config: [security.causal_ipi].

Bootstrap wiring added to runner.rs, daemon.rs, acp.rs. Pre-existing zeph-sanitizer/guardrail feature forwarding bug fixed as a side effect.

Test plan

• cargo +nightly fmt --check passes
• cargo clippy --workspace --features full -- -D warnings — 0 warnings
• cargo nextest run --workspace --features full --lib --bins — 7073/7073 passed
• Warn mode test: classify_injection_warn_mode_above_threshold_returns_suspicious
• Two-stage pipeline tests: aligned→Clean, misaligned→Blocked, error→binary fallback
• Threshold serde validation tests

Follow-up issues to file

• acp.rs inlines wiring instead of shared helpers (DRY gap)
• NoInstruction downgrade confidence threshold (IM-1)
• SNIPPET_MAX_BYTES doc says "chars" not "bytes" (IM-2)
• Probe error/timeout path tests and native.rs causal integration tests
• Suspicious verdict not in SecurityEvent enum