Security evaluation: measure indirect prompt-injection behavior on retrieved-content surfaces

Context

#272's guidance layer shipped via #367: retrieved web pages, PDFs, and pasted third-party text are explicitly data rather than instructions. That is a documented boundary, not evidence that a live model follows it under attack.

This issue tracks the measurable behavioral question separately from structural runtime containment.

Scope

Design and run a bounded, reproducible evaluation across the highest-exposure ARS surfaces:

• web/source verification;
• PDF or manuscript ingestion;
• bibliography intake;
• pasted reviewer or committee comments;
• other text the user pastes into the conversation, such as a manuscript or a source excerpt (added 2026-09-23 from #883; see comment);
• requests served by a fallback model (added 2026-09-23 from #883; see comment).

Use matched benign/injected pairs with frozen model, tool allowance, prompt, and task. Measure at least:

• promotion of embedded text into instructions;
• unauthorized tool/action attempts;
• manipulation of citation or integrity verdicts;
• omission or corruption of the requested artifact.

The evaluation must distinguish platform safeguards from ARS guidance and must not claim that a clean run proves safety.

Acceptance

• Frozen evaluation protocol and threat model.
• Representative matched fixtures with no secret or live exploit material.
• Raw outputs, model/tool configuration, and adjudication rules retained.
• A measurement row under the held-out measurement contract.
• The existing constant-false xfail is replaced by a meaningful executable probe or explicitly retired with rationale.
• Report states the bounded scope and residual risk.

Non-goals

No claim of runtime enforcement, no red-team catalogue, and no automatic security gate.

Split from #272.