fix: cron prompt injection scanner bypass for multi-word variants

[0xbyt4]

Summary

• Fix prompt injection bypass in _scan_cron_prompt regex
• Add 8 regression tests for multi-word injection variants

Bug

The regex ignore\s+(previous|all|above|prior)\s+instructions only matches when there is exactly one keyword between "ignore" and "instructions". Multi-word variants bypass the scanner:

Input	Expected	Actual (before fix)
ignore previous instructions	Blocked	Blocked
Ignore ALL prior instructions	Blocked	Not blocked
ignore all previous instructions	Blocked	Not blocked
ignore the above instructions	Blocked	Not blocked

Root cause: The alternation (previous|all|above|prior) consumes "ALL", then \s+instructions tries to match "prior" and fails.

Fix

Allow optional extra words before and after the keyword alternation:

- (r'ignore\s+(previous|all|above|prior)\s+instructions', "prompt_injection"),
+ (r'ignore\s+(?:\w+\s+)*(?:previous|all|above|prior)\s+(?:\w+\s+)*instructions', "prompt_injection"),

Test plan

• 8 regression tests pass (multi-word variants, case insensitive, false positive checks)
• All existing cron tests still pass
• Full suite: 299 passed, 0 failed