aidefence: load the JSON pattern packs (AIMDS/patterns/*.json) from the Rust aimds-detection core so both lineages share one pattern set

Branch feat/aidefence-injection-packs publishes the detection pattern set as data so it can be shared across implementations:

AIMDS/patterns/core.json                       25 patterns  (the @claude-flow/aidefence 3.0.2 set, verbatim)
AIMDS/patterns/tool_invocation.json             8
AIMDS/patterns/exfil_url.json                   6
AIMDS/patterns/encoded_instruction.json         4
AIMDS/patterns/slack_markup_forgery.json        5
AIMDS/patterns/instruction_override_i18n.json   5

Schema per entry: { id, pack, severity, type, regex, flags, description, examples[], confidence?, engine?, note? } with a pack header { pack, version, enabledByDefault, description, patterns[] }. Loader/validator on the TS side: AIMDS/src/detection/pattern-loader.ts. Corpus fixture with expected verdicts for conformance testing: AIMDS/tests/fixtures/injection-corpus.json (55 threat + 30 safe; every threat case must flag, every safe case except F13/F27 must pass).

Ask

AIMDS/crates/aimds-detection/src/pattern_matcher.rs hardcodes 10 Aho-Corasick literals and 5 regexes. Replace those with a loader for the JSON packs (include_str! at build time or a runtime path) so the Rust core and the TypeScript engine cannot drift.

Portability notes for regex

• Every pattern in the five new packs is lookaround-free and backreference-free and compiles in Rust regex as written.
• Entries with "engine": "js" need lookaround and must be skipped or hand-ported. There is exactly one: CORE-005 you\s+are\s+now\s+(?!going|about|ready).
• flags is a subset of imsu (the global flag is rejected by the validator). Map to a (?imsu) prefix or RegexBuilder. u only matters for case-folding of non-ASCII letters (the i18n pack); Rust regex is Unicode by default.
• \b and \s are ASCII in JavaScript (without u) and Unicode in Rust. The i18n pack was written so every alternative starts and ends on an ASCII letter for that reason.
• Lazy bounded repeats ([^\n]{0,200}?, {0,2048}?) are used throughout and are supported.
• Two core entries were bounded for ReDoS safety (CORE-008, CORE-017); the original 3.0.2 regex is kept in their note field. Rust regex is linear-time anyway, so the bound is only there for the JS side.
• The engine behaviour that is not in the JSON, and would need to be mirrored for full parity: NFKC + zero-width strip + confusables fold; separators/leet/compact text variants (compact form = regex with \s+/\s* removed, matched against whitespace-free text); base64/hex/url decode of blobs ≥ 16 chars (≤ 8 candidates, ≤ 4 KB, printable ratio ≥ 0.9) plus rot13/reversed variants, re-scanned once with every pack except encoded_instruction. See AIMDS/src/detection/{normalize,decoders,engine}.ts.

Timing harness that can be pointed at any pack directory: AIMDS/scripts/regex-timing.cts.

Start with AIMDS/crates/aimds-detection/src/pattern_matcher.rs and compare it with AIMDS/src/detection/pattern-loader.ts, normalize.ts, decoders.ts, and engine.ts. Use AIMDS/tests/fixtures/injection-corpus.json and AIMDS/scripts/regex-timing.cts to validate the loaded packs, Rust-compatible flags, and expected threat and safe verdicts; account for the CORE-005 engine exception and documented parity behavior.