chore: automate ReDoS/config-consistency checks; fix local/CI hook drift

[nkratk]

Summary

Adds permanent, automated safeguards for the two bug classes found manually
during the v0.21.4 hardening pass, so future regressions are caught by the
standard test suite / pre-push hook instead of a one-off human sweep.

• tests/test_redos_safety.py (new): extracts regex patterns via two
  AST shapes — re.<func>(pattern, ...) calls and any call with a
  pattern= keyword argument holding a string literal — and stress-tests
  each with a scaling-ratio check. Found and fixed three real
  catastrophic-backtracking regexes: heuristic_analyzer.py's
  _QA_PATTERN, encoding_detector.py's template_injection, and (after
  broadening the extractor per review below) output_filter.py's email
  PII pattern.
• tests/test_decode_variants.py: content-length consistency
  regression test.
• .githooks/pre-push: fetches origin's tags before running
  scripts/verify.sh — parity fix with the npm sibling, and this exact
  drift was caught live during development (a manual verify.sh run
  passed G11 moments before a commit, then the pushed commit failed G11
  once the fetch revealed the real diff against origin's tag; fixed by
  adding the missing README update).

Independent adversarial review found real issues, all fixed:

1. _QA_PATTERN's 1000-char-bound ReDoS fix created a real many-shot
   detection bypass (parity with the same bug found in npm's sibling PR):
   any turn whose Q→A gap exceeds 1000 chars silently stopped being
   counted (verified 5/5 → 0/5 on a long-turn payload). Replaced with a
   linear marker-position scan (_count_qa_pairs) — no cap, no
   backtracking risk, full detection restored. Added
   tests/test_heuristic_analyzer.py (this guard had no dedicated unit
   tests at all).
2. The extractor only matched re.compile(...) calls — broadened to also
   cover re.search/match/sub/etc. (found no new bugs there), then
   broadened again to the pattern= kwarg shape after review found the
   entire DEFAULT_PII_PATTERNS/DEFAULT_SECRET_PATTERNS list in
   output_filter.py (35 patterns) was invisible to both prior shapes —
   this time it found a real, live bug: the email PII pattern had the
   exact same catastrophic-backtracking shape already fixed elsewhere
   (ExternalDataGuard, npm's output-filter.ts) but never got the parity
   fix here. Fixed with the same bounded pattern used elsewhere.
3. A portability bug: the structural-seed timing loop called
   signal.alarm-based _time_search unconditionally, unlike the
   single-char loop's correct hasattr(signal, "SIGALRM") branch — would
   crash on a platform without SIGALRM (e.g. Windows). Fixed to no-op
   gracefully.
4. Added tests/test_encoding_detector.py coverage for template_injection
   (detection + ReDoS timing) — previously untested after its ReDoS fix.

No behavior change to any guard's detection logic beyond the fixes above.
Mirrors npm PR #25 (nkratk/llm-trust-guard#25).

Test plan

• python3 -m pytest --ignore=tests/adversarial -q — 988 passed
• bash scripts/verify.sh — all gates pass
• Reintroduced each fixed regex in throwaway local edits, confirmed the
  test fails and correctly identifies the offending pattern (clean
  ~16x ratios), then reverted
• Verified _count_qa_pairs matches the original unbounded regex's
  behavior exactly on both short and long (>1000 char) turns
• CI green on all jobs (Python 3.9-3.13, lint, security, verification gate)