refactor: extract safety module into ironclaw_safety crate (#1024)

* refactor: extract safety module into ironclaw_safety crate

Move prompt injection defense, input validation, secret leak detection,
and safety policy enforcement into a standalone crate under crates/.
The safety module was a leaf dependency with no async, no database, and
no other ironclaw traits — only pure computation with pattern matching.

SafetyConfig (2 fields) moves into the crate; env-var resolution stays
in ironclaw's config module as a free function. src/safety/mod.rs becomes
a thin re-export so all existing `crate::safety::*` imports keep working.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* docs: update CLAUDE.md for ironclaw_safety crate extraction

Add guidance to migrate imports from crate::safety to ironclaw_safety
when touching files. Update project structure to reflect crates/ dir.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* refactor: move safety fuzz targets into ironclaw_safety crate

Split fuzz infrastructure:
- crates/ironclaw_safety/fuzz/ — 5 safety-only targets (sanitizer,
  validator, leak_detector, credential_detect, config_env) depending
  only on ironclaw_safety for faster builds
- fuzz/ — keeps fuzz_tool_params which needs ironclaw::tools

Add seed corpus files (51 total) covering each pattern family:
sanitizer injection patterns, validator edge cases, leak detector
secret formats, credential detect HTTP param shapes.

Add new fuzz_credential_detect target exercising
params_contain_manual_credentials with arbitrary JSON.

Co-Authored-By: Claude Opus 4.6 <[email protected]>

* fix: address PR review — single-pass XML escaping and versioned path dep

Rewrite escape_xml_attr from chained .replace() to single-pass char
iteration (O(n) instead of O(4n) with intermediate allocations). Add
version = "0.1.0" to ironclaw_safety path dep to satisfy cargo-deny
wildcards = "deny".

Co-Authored-By: Claude Opus 4.6 <[email protected]>

---------

Co-authored-by: Claude Opus 4.6 <[email protected]>

src/config/mod.rs

@@ -42,6 +42,7 @@ pub use self::llm::default_session_path;
 pub use self::relay::RelayConfig;
 pub use self::routines::RoutineConfig;
 pub use self::safety::SafetyConfig;
+use self::safety::resolve_safety_config;
 pub use self::sandbox::{ClaudeCodeConfig, SandboxModeConfig};
 pub use self::secrets::SecretsConfig;
 pub use self::skills::SkillsConfig;
@@ -306,7 +307,7 @@ impl Config {
             tunnel: TunnelConfig::resolve(settings)?,
             channels: ChannelsConfig::resolve(settings)?,
             agent: AgentConfig::resolve(settings)?,
-            safety: SafetyConfig::resolve()?,
+            safety: resolve_safety_config()?,
             wasm: WasmConfig::resolve()?,
             secrets: SecretsConfig::resolve().await?,
             builder: BuilderModeConfig::resolve()?,

src/config/safety.rs

@@ -1,18 +1,11 @@
 use crate::config::helpers::{parse_bool_env, parse_optional_env};
 use crate::error::ConfigError;
 
-/// Safety configuration.
-#[derive(Debug, Clone)]
-pub struct SafetyConfig {
-    pub max_output_length: usize,
-    pub injection_check_enabled: bool,
-}
+pub use ironclaw_safety::SafetyConfig;
 
-impl SafetyConfig {
-    pub(crate) fn resolve() -> Result<Self, ConfigError> {
-        Ok(Self {
-            max_output_length: parse_optional_env("SAFETY_MAX_OUTPUT_LENGTH", 100_000)?,
-            injection_check_enabled: parse_bool_env("SAFETY_INJECTION_CHECK_ENABLED", true)?,
-        })
-    }
+pub(crate) fn resolve_safety_config() -> Result<SafetyConfig, ConfigError> {
+    Ok(SafetyConfig {
+        max_output_length: parse_optional_env("SAFETY_MAX_OUTPUT_LENGTH", 100_000)?,
+        injection_check_enabled: parse_bool_env("SAFETY_INJECTION_CHECK_ENABLED", true)?,
+    })
 }