fix(taint): only a confirmed injection taints the session (#404)

[Ar9av]

Fixes the taint-escalation false positive in #404.

Problem

An agent reads a page that merely mentions prompt injection (`jailbreak`, `exfiltration`, a quoted "ignore previous instructions"). The regex rule and the keyword heuristic both fire, the session is marked tainted, and every later network call, including a GET to our own blog, is reported as a CRITICAL `secret_exfiltration` block.

Change

Taint now marks only on a confirmed injection:

• the semantic guard's finding when an LLM judge actually answered (new `judged` flag on the finding, derived from the risk mode), or
• a CRITICAL structural hit (injection hidden in HTML comments / CSS / aria-hidden), which needs no judge.

Regex and heuristic-only findings still report exactly as before. They just no longer poison the rest of the session.

Hosts with no judge configured: taint comes only from structural hits. `prismor setup` already asks for a judge; `prismor login` gives the hosted one.

Tests

• `tests/test_taint_judge_gate.py`: heuristic-only does not taint, LLM verdict taints, hidden-HTML taints without a judge.
• Two existing tests seeded taint from bare regex text (the removed behavior); reseeded with a hidden-HTML injection.
• Related suites: 308 passed, `tests/test_mcp_security.py` 31/31.

Co-Authored-By: Claude noreply@anthropic.com

[Madhumasa84]

Hi @Ar9av love this approach,
Gating taint on a confirmed judge verdict (or critical HTML hiding) cleanly stops the false alarms while keeping the exfiltration protection intact. I pulled the branch and tested it locally against the blog reproduction case, all tests passed cleanly.

Minor nit: In policy_engine.py, judged is already calculated on line 2291, so the identical check on line 2306 can be removed.
LGTM