Function is_suspicious_instruction 

pub fn is_suspicious_instruction(content: &str) -> InjectionProbe

Static, regex-based prompt-injection probe.

This is intentionally lightweight and deterministic — it does not call any model. It exists so the harness can:

1. Record prompt_injection_flagged = true on the audit entry.
2. Surface a small annotation inside the fence so the system prompt can remind the model to be careful without silent redaction.