fix: do not block negated reasoning-disclosure safety rules

[joyoner]

Problem

A benign system instruction such as Do not reveal hidden reasoning matches the hard reveal hidden reasoning extraction regex. detectDistill returns distill_blocked (403) before credential/slot routing, even for an ordinary Claude request.

Fix

Skip only regex matches directly preceded by a negative instruction (do not, don't, never, must not, should not). Continue checking subsequent matches: a positive extraction request after the safety instruction still blocks. Harvest needles and other guard layers are unchanged.

Tests

• Regression tests for negative system policies, positive user requests following a negative policy, and positive requests later in the same prompt.
• node --test test/unit/distill-detect.test.mjs
• npm run test:unit
• npx biome check src/lib/core/distill-detect.mjs test/unit/distill-detect.test.mjs
• git diff --check