Add reusable agent guardrails for prompt injection and data leaks

Introduce a pkg/agent/guardrail package with three guardrails that
can be composed into any agent:

- PromptInjectionGuardrail: LLM-based input classifier that detects
  prompt injection attempts before the agent processes them.
- SensitiveDataGuardrail: pattern-based output check for leaked
  tokens, keys, connection strings, and raw SQL.
- SystemPromptLeakGuardrail: configurable output check that detects
  system prompt content in responses using caller-provided
  fingerprints.

The classifier prompt is embedded from a plain text file for easy
review and editing.

Signed-off-by: Bryan Frimin <bryan@getprobo.com>

pkg/agent/guardrail/system_prompt_leak.go

@@ -0,0 +1,55 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package guardrail
+
+import (
+	"context"
+	"strings"
+
+	"go.probo.inc/probo/pkg/agent"
+	"go.probo.inc/probo/pkg/llm"
+)
+
+type SystemPromptLeakGuardrail struct {
+	fingerprints []string
+}
+
+func NewSystemPromptLeakGuardrail(fingerprints []string) *SystemPromptLeakGuardrail {
+	lowered := make([]string, len(fingerprints))
+	for i, f := range fingerprints {
+		lowered[i] = strings.ToLower(f)
+	}
+
+	return &SystemPromptLeakGuardrail{fingerprints: lowered}
+}
+
+func (g *SystemPromptLeakGuardrail) Name() string {
+	return "system-prompt-leak"
+}
+
+func (g *SystemPromptLeakGuardrail) Check(_ context.Context, message llm.Message) (*agent.GuardrailResult, error) {
+	text := strings.ToLower(message.Text())
+
+	for _, fp := range g.fingerprints {
+		if strings.Contains(text, fp) {
+			return &agent.GuardrailResult{
+				Tripwire: true,
+				Message:  "response contains system prompt content",
+			}, nil
+		}
+	}
+
+	return &agent.GuardrailResult{Tripwire: false}, nil
+}