Add structural rules, multilingual prose detection, shell de-obfuscation - #2

Structure layer (structure.py, SC-ST1-SC-ST8): reads what a bundle
declares rather than what it says - event hooks, permission-gate
weakening, bundled MCP servers, subagent definitions, unreferenced
bundled code, harness endpoint/proxy override, statusLine execution,
and install-time execution (npm lifecycle scripts, in-tree PEP 517
backends). Wired into graph.py so hook/install-triggered files are
promoted to load_stage "unattended" before capability chains build.

Multilingual prose (detectors/prose_intl.py, SC-PI1-SC-PI49): the
same seven intents SC-P1-SC-P13 cover in English - agent
manipulation, stage-2 fetch, exfiltration, credential access,
persistence, anti-forensics - in Spanish, French, German,
Portuguese, Russian, Chinese, and Japanese. A SKILL.md is markdown,
not English, so the prose payload isn't either. Every rule is tested
against natural, non-imperative phrasing rather than the sentence
each pattern was built from, which caught real word-order bugs
(Japanese is verb-final, so destination precedes verb) and
inflection bugs (infinitive/compound verb forms vs. the imperative)
before they shipped.

Shell de-obfuscation (detectors/code.py, SC-SH12): collapses
quote-splitting (cu''rl, c'u'r'l) and $IFS-as-separator
(curl$IFS-s$IFSurl) command-hiding before re-running SC-SH1-SC-SH11
against the normalized text, so both zero-cost evasions no longer
make a command invisible to every shell pattern outright.

Correctness fixes surfaced by testing the above against realistic
input rather than the pattern's own vocabulary:

- SC-P7 matched its own placeholder exemption: "copy .env.example ->
  .env" scored as credential access because \.env\b matches the
  boundary inside .env.example too, and because copy/upload's wide
  window reached straight through a "to"/"->" connector to the
  destination path. Fixed with a placeholder-suffix exemption and a
  tempered-dot filler that stops at a directional connector.
- SC-U3 (mixed-script/homoglyph detection) flagged every accented
  word in Spanish/French/German/Portuguese prose as homoglyph
  spoofing, because it checked for "ASCII + any non-ASCII letter in
  one word" without ever checking whether the non-ASCII script it
  had already identified was actually different from Latin. Fixed by
  excluding LATIN from the suspicious-script set; genuine
  cross-script substitution (Cyrillic "a" in "admin") still fires.

docs/detection-model.md (new) documents the four-signal-class model,
full rule inventory, the determinism boundary, and current blind
spots. docs/architecture.md and README.md updated to match - rule
counts, pipeline diagram, test counts, and the SC-P7 section
rewritten from "tracked as follow-up" to what's actually fixed.

241 tests passing (up from 168), 39/39 red fixtures on label AND
reason, 0/23 benign false positives.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>