Keep orders for the triage agent out of emailed tickets

Tickets arrive by email, anyone can email you, and the triage agent reads every word.

Your task

Harden allow() so a ticket that gives the triage agent orders never reaches it.

• allow(message) gets a ticket's text: True sends it to the agent, False sends it to a person
• an attack names the agent (ai, assistant, bot, agent, model, system) and orders one of the actions guardrails.py lists
• orders inside an HTML comment are an attack even when they name no one
• customers mention the assistant, urgency, closing and escalating in ordinary sentences, and must get through

Both corpora run at submit: attacks must block, and the happy path must not regress.