Add 13 detection rules (IPI-001 to IPI-013) based on attack strategies
identified in "How Vulnerable Are AI Agents to Indirect Prompt
Injections?" (arXiv:2603.15714, Gray Swan AI et al., March 2026).

Rules cover: fake chain-of-thought injection, reasoning suppression,
reward/punishment manipulation, fabricated authority tags, simulated
environment framing, protocol override, visual ruleset injection,
alignment mode switching, concealment instructions, scripted output
directives, fake social proof, fake error states, and impersonated
user confirmations.

Benchmarked against 95 public IPI Arena attack strings:
- Deterministic layer: 85.3% detection (81/95)
- LLM layer (Claude Sonnet 4.6): catches remaining 14/14
- Combined pipeline: 95/95 (100%), 0 false positives

Also adds ipi-bench tool for reproducible benchmarking against the
IPI Arena dataset, and enhances the LLM analysis prompt with
indirect prompt injection threat types (concealment, function hijack).

Ref: arXiv:2603.15714