feat(llm-security): wire TRG scanner into orchestrator and policy

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3s6WnubSSrFjAQTLQdVbG

scanners/lib/policy-loader.mjs

@@ -65,6 +65,24 @@ const DEFAULT_POLICY = Object.freeze({
     // Substring matches against relative path — plain contains, no glob.
     suppress_paths: [],
   },
+  // TRG — trigger/activation-abuse scanner. Lists mirror the scanner defaults
+  // in scanners/trigger-scanner.mjs; override any of them via policy.json.
+  trg: {
+    mode: 'warn',
+    baiting_phrases: [
+      'anything', 'everything', 'always', 'whenever', 'no matter what',
+      'any request', 'any task', 'any file', 'every time',
+      'all files', 'all messages', 'all requests',
+    ],
+    builtin_names: [
+      'read', 'write', 'edit', 'bash', 'glob', 'grep', 'task',
+      'webfetch', 'websearch', 'notebookedit', 'todowrite',
+      'ls', 'cat', 'agent', 'search', 'fetch',
+    ],
+    broad_single_words: [
+      'run', 'do', 'go', 'help', 'fix', 'use', 'get', 'set', 'all', 'any', 'it', 'this', 'that',
+    ],
+  },
 });
 
 // Cache loaded policy per project root

scanners/lib/severity.mjs

@@ -143,6 +143,7 @@ export const OWASP_MAP = Object.freeze({
   SCR: ['LLM03'],
   PST: ['LLM01', 'LLM06'],
   WFL: ['LLM02', 'LLM06'],
+  TRG: ['LLM06'],
 });
 
 /**
@@ -162,6 +163,7 @@ export const OWASP_AGENTIC_MAP = Object.freeze({
   SCR: ['ASI04'],
   PST: ['ASI02', 'ASI03', 'ASI04', 'ASI05'],
   WFL: ['ASI04'],
+  TRG: [],
 });
 
 /**
@@ -181,6 +183,7 @@ export const OWASP_SKILLS_MAP = Object.freeze({
   SCR: ['AST06'],
   PST: ['AST01', 'AST03'],
   WFL: [],
+  TRG: ['AST04'],
 });
 
 /**
@@ -200,6 +203,7 @@ export const OWASP_MCP_MAP = Object.freeze({
   SCR: ['MCP04'],
   PST: ['MCP02', 'MCP07'],
   WFL: [],
+  TRG: [],
 });
 
 /**