feat(lexicon): publish a commons-owned pattern id with per-runtime aliases

A conformance fixture has to name a finding. The two runtimes that seed this
repository do not name the same pattern the same way -- llm-security says
"override: ignore previous instructions", the guard says
"override:ignore-previous" -- so until now no expected.json could be written
at all, including for the 64 patterns whose regex is byte-identical in both.

Each pattern now carries `id` plus an `aliases` object naming what each
seeding runtime calls it, and a top-level pattern_id_space block explains the
field, its provenance and its stability contract.

The id is adopted verbatim from the guard's port rather than invented here:
that port already carries both names, so the mapping is read from source data.
Matched by label <-> desc with em-dash normalised to hyphen, 83/83 one-to-one,
83 unique ids.

No detection data moved, and that is proven rather than asserted: labels,
patterns and flags are byte-identical in sequence, no flags key was invented
(78 before, 78 after), and stripping id + aliases + pattern_id_space
reproduces the previous committed file byte for byte -- 23566 bytes. All 83
patterns still compile in Node bare and under u (166/166) and in Python re
(83/83).

Neither consumer has ratified this id space; both were asked by coord today,
and the file records it as a proposal rather than implying agreement.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FaYqid3mejFmd9ZHsiHgp3

CHANGELOG.md

@@ -51,17 +51,37 @@ checks that were not run instead of attaching a caveat to a pass.
   changed** — behaviour preservation holds and the finding is reported to the owning
   repositories.
 
+### Changed
+
+- `lexicon/injection-lexicon.json` **0.1.0 → 0.2.0** — every pattern gains a commons-owned
+  `id` and an `aliases` object naming what each seeding runtime calls it, plus a top-level
+  `pattern_id_space` block explaining the field. This exists because a `conformance/`
+  fixture has to name a finding and the two runtimes do not name the same pattern the same
+  way.
+
+  The id was **adopted verbatim from the guard's port**, which already carried both names,
+  rather than invented here. Matching was by `label` ↔ `desc` with em-dash normalised to
+  hyphen: 83/83, one-to-one, ids unique.
+
+  **No detection data moved.** Labels, patterns and flags are byte-identical in sequence,
+  no `flags` key was invented (78 before, 78 after), and stripping the three new fields
+  reproduces the previous committed file byte for byte — 23 566 bytes, identical. All 83
+  patterns still compile in Node bare and under `u` (166/166) and in Python `re` (83/83).
+
+  Neither `llm-security` nor the guard has ratified this id space yet; both were asked by
+  coord on 2026-08-09, and the file says so rather than implying agreement.
+
 ### Not included
 
 - `signatures/malware-signatures.json` — seed data not yet delivered.
 - `spec/decode-pipeline.md` — needs the decode implementation. A normative spec inferred
   from a data dump would be worse than an absent one.
-- `conformance/` — blocked, and the blocker is now identified. 105 of the guard's 134
+- `conformance/` — still absent, with half the blocker cleared. 105 of the guard's 134
   coverage cases are convertible to static `input.txt`/`expected.json`; the other 29 assert
-  a runtime's API surface, which this repository does not own. But no fixture can be written
-  yet at all: an `expected.json` names findings, and the two runtimes have no shared name for
-  the same pattern (`override:ignore-previous` vs `override: ignore previous instructions`).
-  A commons-owned pattern id is a prerequisite for the corpus, not a parallel task.
+  a runtime's API surface, which this repository does not own. Findings can now be **named**
+  (see `pattern_id_space` above), but 13 patterns still have no agreed **expected
+  behaviour** — the two ports genuinely differ on them — so those fixtures cannot be
+  authored until the owning repositories answer.
 
 These are named in the README as planned rather than linked, so nothing in the repository
 points at a file that does not exist.