feat(llm-security): wire SIG scanner into orchestrator and policy

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3s6WnubSSrFjAQTLQdVbG

scanners/lib/policy-loader.mjs

@@ -83,6 +83,12 @@ const DEFAULT_POLICY = Object.freeze({
       'run', 'do', 'go', 'help', 'fix', 'use', 'get', 'set', 'all', 'any', 'it', 'this', 'that',
     ],
   },
+  // SIG — known-bad-identity signature engine. Toggle families or point at a
+  // custom ruleset via policy.json.
+  sig: {
+    enabled_families: ['webshell', 'reverse_shell', 'cryptominer', 'hacktool'],
+    custom_rules_path: null,
+  },
 });
 
 // Cache loaded policy per project root

scanners/lib/severity.mjs

@@ -144,6 +144,7 @@ export const OWASP_MAP = Object.freeze({
   PST: ['LLM01', 'LLM06'],
   WFL: ['LLM02', 'LLM06'],
   TRG: ['LLM06'],
+  SIG: ['LLM03', 'LLM02'],
 });
 
 /**
@@ -164,6 +165,7 @@ export const OWASP_AGENTIC_MAP = Object.freeze({
   PST: ['ASI02', 'ASI03', 'ASI04', 'ASI05'],
   WFL: ['ASI04'],
   TRG: [],
+  SIG: ['ASI04'],
 });
 
 /**
@@ -184,6 +186,7 @@ export const OWASP_SKILLS_MAP = Object.freeze({
   PST: ['AST01', 'AST03'],
   WFL: [],
   TRG: ['AST04'],
+  SIG: [],
 });
 
 /**
@@ -204,6 +207,7 @@ export const OWASP_MCP_MAP = Object.freeze({
   PST: ['MCP02', 'MCP07'],
   WFL: [],
   TRG: [],
+  SIG: [],
 });
 
 /**