refactor(llm-security): build the SIG ruleset from vendored commons (malware-signatures 0.1.0)

Fifth and last consumer swap of v8 Phase 5 step 4. The seven known-bad-identity
signatures stop living in knowledge/signatures.json and are built from the
vendored commons artifact signatures/malware-signatures.json instead.

Measured before the swap over all seven positions -- id, family, severity,
pattern, description, provenance, key order, and recompilation identity under
the engine's unconditional `i` flag: zero divergences over 56 checks, in order.
The commons copy was extracted from this repository's own file at b0de0ca and
had not drifted.

knowledge/signatures.json is REMOVED rather than left in place. Keeping it would
have left two files spelling one table with nothing gating the drift, and its
golden `file:` pin would have gone on passing while pinning bytes no scanner
reads -- a gate reporting success without running. The pin is replaced by a
walked-module anchor over SIGNATURE_RULES, which is strictly stronger: the pin
covered the bytes on disk, the walk covers what `new RegExp` made of them.
Golden diff was exactly that and nothing else: 7 ADDED, 1 REMOVED, 0 CHANGED
(102/7/5 -> 109/7/4), each added source verified equal to the recompiled commons
pattern.

compileRules() moves into the new lib module and is exported, so the built-in
ruleset and the operator's sig.custom_rules_path path keep one implementation
rather than two copies of the defaulting logic.

Coverage by construction, not by memory: the probe table in the scanner test is
asserted against the LOADED ruleset, so a rule commons adds cannot arrive
without an end-to-end probe. Mutation of the vendored JSON fires in three
directions -- under-match (xmrig alternative dropped) reddens two scanner tests
plus golden; over-match (webshell rule widened to a bare `shell`) reddens the
clean-fixture false-positive probe plus golden; reorder reddens the declared-
order test plus golden.

Loud failure is contract: an unresolvable commons writes one line to stderr
rather than silently disabling known-malware detection, and never throws.

Suite 2247 / 2241 pass / 6 skipped / 0 fail. suite-counts.json untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0151x4FVg9Mn55C2LvHLpHKo

scanners/signature-scanner.mjs

@@ -13,71 +13,22 @@
 // Zero external dependencies — Node.js builtins only.
 
 import { readFile } from 'node:fs/promises';
-import { join, dirname, isAbsolute, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { isAbsolute, resolve } from 'node:path';
 import { finding, scannerResult } from './lib/output.mjs';
 import { readTextFile } from './lib/file-discovery.mjs';
 import { normalizeForScan, foldHomoglyphs, rot13 } from './lib/string-utils.mjs';
 import { getPolicyValue } from './lib/policy-loader.mjs';
-
-const __dirname = dirname(fileURLToPath(import.meta.url));
+import { SIGNATURE_RULES, compileRules } from './lib/malware-signatures.mjs';
 
 // Paths excluded from signature scanning when present under the scan root:
-// our own ruleset, test fixtures, and docs all legitimately contain patterns
-// that would otherwise self-flag.
+// test fixtures and docs legitimately contain patterns that would otherwise
+// self-flag. `knowledge/` is kept even though the ruleset itself moved to the
+// vendored commons in v8 Phase 5 — a scanned target's own knowledge/ directory
+// is as likely to hold ruleset-shaped prose as ours was.
 const EXCLUDED_PATH_RE = /(^|\/)(knowledge|tests|docs|node_modules)\//i;
 
 const DEFAULT_FAMILIES = ['webshell', 'reverse_shell', 'cryptominer', 'hacktool'];
 
-// Cached, compiled ruleset (loaded once per process).
-let _rules = null;
-
-/**
- * Compile a parsed ruleset object ({ rules: [...] }) into executable rules.
- * Each rule's `pattern` is compiled to a case-insensitive RegExp; rules whose
- * pattern fails to compile (or that lack id/pattern) are dropped.
- * @param {object} parsed
- * @returns {Array<{id,family,severity,re,description,provenance}>}
- */
-function compileRules(parsed) {
-  const compiled = [];
-  for (const rule of parsed.rules || []) {
-    if (!rule || !rule.id || !rule.pattern) continue;
-    let re;
-    try {
-      re = new RegExp(rule.pattern, 'i');
-    } catch {
-      continue; // skip uncompilable patterns
-    }
-    compiled.push({
-      id: rule.id,
-      family: rule.family || 'unknown',
-      severity: rule.severity || 'high',
-      re,
-      description: rule.description || rule.id,
-      provenance: rule.provenance || null,
-    });
-  }
-  return compiled;
-}
-
-/**
- * Load and compile signatures.json.
- * Graceful fallback to an empty ruleset on any load/parse error.
- * @returns {Promise<Array<{id,family,severity,re,description,provenance}>>}
- */
-async function loadRules() {
-  if (_rules) return _rules;
-  const rulesetPath = join(__dirname, '..', 'knowledge', 'signatures.json');
-  try {
-    const raw = await readFile(rulesetPath, 'utf8');
-    _rules = compileRules(JSON.parse(raw));
-  } catch {
-    _rules = []; // graceful: no ruleset -> no findings
-  }
-  return _rules;
-}
-
 /**
  * v7.8.3 (#36): load operator-supplied rules from the documented
  * `sig.custom_rules_path` policy option. Relative paths resolve against the
@@ -127,7 +78,7 @@ export async function scan(targetPath, discovery) {
   let filesScanned = 0;
 
   try {
-    const rules = [...await loadRules(), ...await loadCustomRules(targetPath)];
+    const rules = [...SIGNATURE_RULES, ...await loadCustomRules(targetPath)];
     const enabledFamilies = new Set(
       (getPolicyValue('sig', 'enabled_families', DEFAULT_FAMILIES, targetPath) || []).map(f => String(f)),
     );