New signal: persistence / auto-run registration (surviving a reboot)

[squid-protocol]

Part of epic #1171.

🛑 Problem Statement

The GlassWorm-style detector (#1150/PR #1169, plus #1172/#1173/#1174) covers how a worm spreads
(self_propagation), what it hides its payload with (unicode_steganography), and — pending
#1173 — what it's after (credential_targeting). It has no signal for a fourth common worm/dropper
behavior: making itself survive a reboot or a fresh shell session by registering itself in a
well-known auto-run location.

🎯 Objective

Add a signal that fires when source code writes to one of a bounded set of well-known auto-run
registration points:

• Shell profile files (~/.bashrc, ~/.zshrc, ~/.profile) — specifically an append to these,
  not just any reference to the filename
• crontab (via crontab - piping, or direct writes to /etc/cron.d/, /var/spool/cron/)
• systemd user unit files (~/.config/systemd/user/*.service)
• PowerShell $PROFILE (append/write)
• Windows registry Run/RunOnce keys (HKCU\...\Run, reg add ... /v ... /d)

🛠️ Proposed Implementation

New THREAT_SIGNATURES entry (working name: persistence_registration) matching a write/append
call whose target path or key matches the bounded list above. Follow the same discipline as
self_propagation: the target must be the literal argument to a write/append call, not just
present somewhere nearby in the file, to keep false positives near zero (dotfile management tools,
shell-config generators, and systemd unit templating are all real, legitimate use cases that
reference these same paths).

✅ Acceptance Criteria

• Synthetic tests prove detection for at least: bash profile append, crontab write, and one of
  systemd-unit/PowerShell-profile/registry-Run-key
• False-positive guard tests: legitimate dotfile-management tooling (e.g. a script that
  reads .bashrc to check its contents, or a templating tool generating a systemd unit file
  as a build artifact rather than writing directly to the live path) must not fire
• Verified against the full language-crucible corpus: zero unintended hits before the
  golden-master rebless
• ReDoS timing sweep on the new pattern