fix(0.4.0): G9 injection — Codex round-1 blockers

[himerus]

Summary

Addresses four post-merge Codex adversarial-review blockers on PR #25 (G9 three-tier injection classifier). Patch-level bump targeted for the 0.4.0 line so rea can ship with the injection middleware behaving as advertised.

Closes the round-1 + round-2 Codex concerns on that classifier in a single follow-up PR:

• [high] denyOnSuspicious defaulted to false on action: 'block' + flag unset, silently loosening 0.2.x injection_detection: block behavior for non-bst consumers upgrading to 0.3.0. Middleware now defaults to true in that case, restoring 0.2.x parity. The zod schema no longer applies a default for suspicious_blocks_writes, so absence is distinguishable from an explicit false. Consumers who want the looser warn-only posture must opt in via injection.suspicious_blocks_writes: false. bst-internal* profiles continue to pin true.
• [high] The 7-phrase ASCII pattern library was trivially bypassed by Unicode whitespace (NBSP, en/em/ideographic space), zero-width joiners, and fullwidth compatibility characters. Inputs are now NFKC-normalized, zero-width-stripped, Unicode-whitespace-collapsed, and lowercased before literal matching. The phrase library was also expanded with two narrow persona-swap vectors (pretend you are, roleplay as). Broader candidates (act as a / act as an / pretend to be) were considered but dropped — at read tier a single literal match escalates to likely_injection, which would deny benign prose like "this proxy can act as a bridge." Pattern-set extensibility via policy is filed as G9.1 follow-up.
• [medium] decodeBase64Strings was exported and tested but never wired into the middleware execution path — 28 lines of dead code advertised as a second-opinion base64 probe. It is now invoked after the primary scan; any phrase detected in a decoded whole-string payload is merged into base64DecodedMatches and triggers classification rule chore(ci)(deps): bump actions/setup-node from 4.0.3 to 6.3.0 #2 (likely_injection).
• [low] On worker-bounded regex timeout, the audit record carried timing metadata under injection.regex_timeout but no verdict field under injection. A new verdict: 'error' value is emitted when a timeout produces no actionable signal, giving downstream audit consumers a stable record shape. A new InjectionMetadataSchema zod schema is added to the injection middleware module for internal test coverage; promoting it to a public package entrypoint is tracked as G9.2 follow-up (the module is not reachable through the current exports map).

Behavior change

Non-bst consumers with injection_detection: block will now block on suspicious classifications by default, restoring 0.2.x parity. This is a narrow tightening for consumers who upgraded to 0.3.0 without adding the new injection: block. To restore the 0.3.0 looser behavior, opt out explicitly:

injection:
  suspicious_blocks_writes: false

likely_injection continues to deny unconditionally in all configurations.

Follow-ups filed

• G9.1 — policy-driven extensibility of the injection phrase library
• G9.2 — promote InjectionMetadataSchema to a public entrypoint for downstream audit-consumer validation (Helix, etc.)

Test plan

• pnpm lint — clean (including lint:regex safe-regex check)
• pnpm type-check — strict, 0 errors
• pnpm test — 440 passed / 1 skipped (53 injection-specific tests, 2 new regression guards against the dropped broad patterns)
• pnpm build — clean tsc -p tsconfig.build.json
• /codex-review round-1 blockers addressed in follow-up commit (narrowed persona-swap patterns, schema scope clarified)
• Changeset: .changeset/fix-0.4.0-g9-injection.md (patch bump)
• All commits DCO-signed
• CI status checks green on PR
• CODEOWNERS review on protected-path diff (src/gateway/middleware/)

Files touched

• src/gateway/middleware/injection.ts — normalizeForMatch, decodeBase64Strings wiring, verdict: 'error', InjectionMetadataSchema, narrowed phrase library, denyOnSuspicious tri-state default
• src/gateway/middleware/injection.test.ts — 4 new describe blocks covering all 4 findings + 2 regression guards
• src/policy/loader.ts — drop default on suspicious_blocks_writes (make presence observable)
• src/policy/loader.test.ts — updated expectations for absence-preservation
• src/policy/types.ts — suspicious_blocks_writes?: boolean (optional)
• src/gateway/server.ts — conditionally omit suspiciousBlocksWrites when unset (preserves tri-state to middleware under exactOptionalPropertyTypes)
• .changeset/fix-0.4.0-g9-injection.md — patch changeset