feat: Implement Input Guard (prompt injection sanitizer)

[dcplatforms]

Overview

Implement the Input Guard — all external data entering any agent's context MUST pass through this component before being used.

Architecture: docs/ARCHITECTURE.md §5.3

Implementation

• InputGuard class in src/security/input_guard/
• Classify content: DATA | INSTRUCTION | HYBRID
• Strip instruction-pattern content from data sources (logs, alerts, API responses)
• Wrap all external input in <DATA_CONTEXT source='...'> tag — never SYSTEM_INSTRUCTION
• Detection signals: instruction verbs in log data, role manipulation patterns, tool invocation syntax, oversized fields
• Source trust score propagation to memory provenance

Tests Required

• Clean log → pass through with DATA_CONTEXT wrapper
• Log containing 'ignore previous instructions' → strip + alert
• Log containing tool invocation syntax → strip + alert
• Trusted source (trust_score=0.95) vs untrusted (0.40) → different handling