feat: audio overlay and suffix tool-risk injection probes

[codingshreyash]

What this changes

Adds two audio injection probes on top of the probe and detector infrastructure in #10.

AudioOverlayInjection mixes a spoken tool-risk instruction underneath a benign carrier utterance at reduced gain. It follows the overlay threat model from AudioJailbreak (arXiv:2505.14103) and sweeps the payload's gain and position.

AudioSuffixInjection appends a spoken tool-risk instruction after a benign carrier utterance. Optional speed and noise transforms are applied only to the suffix, leaving the carrier unchanged. This models an attacker who can control the appended clip but not the original audio.

Both probes support foreground_only and background_only. They also run the intelligibility check before scoring, so an unintelligible composite is not counted as a successful result.

Why

A plain spoken-request probe tests how the target responds to a directly audible instruction. These probes cover two additional audio-specific cases: placing an instruction underneath a benign utterance, and appending it as a separate audio segment.

Those cases are not represented by text-only probes.

Verification

Confirmed by hand that both conditions produce the expected composite audio and that the intelligibility gate drops composites the ASR check cannot transcribe. A live target run is not run in CI:

garak -t <target_type> -n <model_name> -p audio_overlay,audio_suffix