bench(iabench): implement IA-7 escalation-routing task

[adris-misra]

Part of #2 (PR 4 of 5). Tracking issue remains open until PR 5.

Summary

Implements IA-7 (escalation-routing appropriateness), the final task in the
IABENCH-v1.0 main suite. After this PR all 7 main tasks are implemented
(IA-LIN remains supplementary).

IA-7 measures the real HITLSupervisorAgent against the routing policy
documented in config/escalation_rules.yaml. Ground truth is hand-authored
in ia7_routing_cases.json from the documented rules — no code oracle
derives it, so the measurement is not circular.

Honest result: routing_F1 = 0.542 (FAIL)

This is the intended, honest outcome. The HITLSupervisorAgent implements
only one of the four documented escalation rules:

• Implemented: low_confidence_decision (confidence < 0.85 → escalate) ✓
• Not implemented: safety_interlock (irreversibility + intent
  patterns), purdue_zone_violation, write_to_level0

All 7 block-class cases mismatch (block precision/recall/f1 = 0.0);
auto_proceed and escalate classes score near-perfect. The agent never emits
a block/halt verdict, so safety-critical actions — a high-confidence
"emergency e-stop override" (r021), an irreversible actuator write (r016),
and a zone-4-agent write to zone-0 (r020) — all auto-proceed.

This safety gap is tracked in #17.

Anti-circularity note

The first IA-7 implementation computed routing with a _evaluate_routing_policy()
function that the ground-truth test also used — a tautology yielding a fake
routing_F1=1.000. That function was deleted; the benchmark now invokes the
real HITLSupervisorAgent.handle() with no short-circuit, and a test-local
_documented_policy_oracle (never called by the harness) validates the
hand-authored ground truth independently.

What was built

• _run_task_ia7() — runs all 22 cases through the real HITLSupervisorAgent;
  macro-F1 across auto_proceed/escalate/block; reports mean_time_to_escalation_ms
• benchmarks/data/ia7_routing_cases.json — 22 cases with agent_zone/target_zone/
  rationale, covering the full decision matrix plus intent-pattern (r021/r022)
  and Purdue-violation (r019/r020) cases
• benchmarks/tasks/task_ia_7.yaml — status → implemented
• benchmarks/industrial_agent_benchmark.md — IA-7 marked implemented
• tests/unit/test_iabench.py — TestDocumentedPolicyOracle (independent
  policy oracle), updated TestLoadRoutingCases

Verification

• ruff check . → passed
• ruff format --check . → passed
• mypy src/ → Success, no issues in 41 files
• bandit -r src/ -c pyproject.toml -ll → no issues
• pytest tests/unit/test_iabench.py -q → 98 passed (after merging main: 63 IA-7-branch + 35 IA-4/IA-6 tests)

Health-check (llama3.2:1b via Ollama)

routing_F1 is model-independent (routing is config-driven, not LLM-based),
so this result holds regardless of model. Model set via OLLAMA_MODEL env var
(#14).

Class	Precision	Recall	F1
auto_proceed	0.583	1.000	0.737
escalate	0.800	1.000	0.889
block	0.000	0.000	0.000
macro			0.542

Follow-up issues

• IA-1: anomaly_root_cause agent returns "unknown" instead of structured fault type (Llama 3.1 8B baseline) #10 — IA-1 anomaly agent returns "unknown"
• IA-3: safety_guardrail blocks 20/20 benign prompts (Llama 3.1 8B baseline) #11 — IA-3 guardrail over-blocks benign prompts
• IA-2: tacit_knowledge_curator returns empty results because ChromaDB corpus is not indexed #13 — IA-2 ChromaDB corpus not indexed
• --model CLI flag not forwarded to agent llm.complete() calls #14 — --model flag not forwarded to agents
• test_bench_exits_nonzero invokes full bench CLI; hangs locally when Ollama is running #16 — test_bench_exits_nonzero invokes full bench CLI
• HITLSupervisorAgent implements only low-confidence routing; ignores safety_interlock, purdue_zone_violation, and write_to_level0 rules #17 — HITLSupervisorAgent implements only low-confidence routing (this PR's finding)