Add PyRIT agent red-team pipeline

[liamcrumm]

Summary

• Add pipeline.red_team, backed by exact-pinned pyrit==1.0.1, as an ASSERT-owned attack, execution, scoring, and viewer path.
• Reuse existing model, callable, endpoint, and connector target sessions. Plans that declare outbound sinks require a traced callable or hosted model with a real tool-module backend.
• Emit normal taxonomy.json, test_set.jsonl, inference_set.jsonl, scores.jsonl, node judgments, native result summaries, and viewer metadata.
• Add a secretless tool-using agent example where PyRIT misses a tool-argument disclosure in the final response and ASSERT captures it from the trajectory.
• Add a manual least-privilege workflow with SHA-pinned actions.
• Make the dormant DSPy GEPA extra resolvable on current PyPI and declare its uv conflicts with the examples bundles.

Validation

• 1146 passed, 74 skipped, 481 subtests passed
• npm run check --prefix viewer
• npm run build --prefix viewer
• uv lock --check
• python -m build and twine check dist/*
• Built-wheel smoke without the redteam extra
• Secretless run with only the redteam extra
• Two real PyRIT runs in one Python process
• Provider input refusal, auth failure, partial failure, and target error repros
• Rebuild from the run-local copied config and attack-data snapshot
• End-to-end example result: PyRIT final-response score false, ASSERT trajectory policy_violation: true, evidence post_diagnostic.message

Current scope

• Supports PyRIT PromptSendingAttack with Foundry-compatible Baseline and risk-category labels.
• Uses one impermissible risk category, deterministic substring scoring, and explicit outbound sink declarations.
• Adaptive multi-turn attacks, semantic scoring, and live hosted or managed-agent validation remain follow-up work.