feat(scripts): detect how a model evades, not just whether

classify_refusal() separates refusal (head), preamble, appended disclaimer
(tail) and moralising insert (inline). Only the first three are meaningful, and
only where a prompt forbids them: a preamble on a coding answer is normal, so it
no longer counts as evasion.

Two sources of false positives had to be removed first, both found by checking
the detector's hits against the archive rather than trusting them:

  * llamacppctl's own truncation warning on stderr had leaked into an archived
    output and was read as a model disclaimer. It also inflated that run's word
    count, so count_words() strips it too.
  * An AI character saying "Bitte beachten Sie:" inside a dystopian story is
    plot, not distancing. Quoted speech is removed before markers are matched.

run_prompt_suite.sh gains a CASES filter so a single prompt can be re-run.

Measured result, recorded in KI_TOOLS_PROFILES.md: across seven prose prompts
neither the abliterated model nor the aligned base model evaded once. On
literary prose the abliteration buys nothing measurable.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

scripts/run_prompt_suite.sh

@@ -21,6 +21,7 @@
 #                16000 brechen Prosa/Reden mitten im Denken ab)
 #   CLI          Pfad zum CLI   (Default: ./.venv/bin/llamacppctl)
 #   OVERWRITE    1 = vorhandene Ausgaben ueberschreiben (Default: 0 = ueberspringen)
+#   CASES        Leerzeichenliste von Fallnummern, z. B. "06 07 08" (Default: alle)
 #
 set -uo pipefail
 
@@ -68,6 +69,10 @@ for domain in "$@"; do
     number=$(echo "$base" | cut -d_ -f2)    # z. B. 01
     out="$OUT_DIR/${LABEL}_${domain}_${number}.out.txt"
 
+    if [ -n "${CASES:-}" ] && ! echo " $CASES " | grep -q " $number "; then
+      continue
+    fi
+
     if [ -e "$out" ] && [ "$OVERWRITE" != "1" ]; then
       echo "== $base -> vorhanden, uebersprungen (OVERWRITE=1 erzwingt)"
       continue