research: add fleet-wide caller reputation with cross-agent threat propagation

Motivation

Investigate whether privacy-bounded caller risk evidence can be shared across router replicas or cooperating agents inside an explicit trust domain. Current main has no fleet-wide caller-reputation system, and Router Memory must not be used as one.

Preconditions

• Trusted, impersonation-resistant caller/tenant identity (#2362).
• Typed local risk observations and session-level evaluation (#2543).
• Explicit operator-defined trust domain, retention policy, and threat model.
• Router Learning experience/state contract (#2238/#2243).

Research scope

1. Define content-minimized, signed/attested risk observations with source, policy/model version, event class, uncertainty, timestamp, and expiry.
2. Define federation boundaries: tenant isolation, allowed producers/consumers, namespace, residency, and revocation.
3. Aggregate asynchronously with decay, minimum evidence, uncertainty, and poisoning/outlier defenses.
4. Separate observed evidence from derived caller risk and from an enforcement decision.
5. Feed a derived signal into classification/decision policy only after shadow evaluation.
6. Compare local-only, shared-within-replica-set, and federated modes.
7. Design correction/appeal, deletion, audit, and recovery semantics.

Boundaries

• No global universal reputation identity.
• No identity derived from prompt text, IP alone, or arbitrary headers.
• No raw prompts, memory entries, or tool arguments in the shared evidence by default.
• Cross-agent evidence cannot directly bypass local authorization or safety policy.
• Sparse, conflicting, stale, or unverifiable evidence fails to unknown.
• No synchronous federation call on the routing hot path.

Acceptance criteria

• Threat model covers spoofing, Sybil behavior, poisoning, collusion, replay, privacy leakage, and tenant crossover.
• Trust-domain and identity prerequisites are machine-validated.
• Schemas, signatures/attestation, TTL, correction, and deletion behavior are tested.
• Shadow evaluation reports false positives, uncertainty, and subgroup/tenant isolation.
• Every downstream policy effect is reconstructable with bounded reasons.
• Loss of the shared store has a documented safe degradation mode.
• Live enforcement requires an explicit later approval gate.

Likely change surfaces

src/semantic-router/pkg/routerruntime/, src/semantic-router/pkg/routerreplay/, src/semantic-router/pkg/classification/, src/semantic-router/pkg/extproc/, src/semantic-router/pkg/config/, observability, security docs, and tests.

Depends on #2362 and #2543. Related: #2238, #2243, #2357, #2547.