fitness: drive authority cues from AttackFocus / policy instead of hard-coded APR list

[CodewithJha]

Problem

packages/mutiny_core/src/mutiny_core/fitness/__init__.py _premise_signal uses hard-coded cues:

cues = ("apr-", "approved", "manager", "authorization", "legal", "override")

PRODUCTION_READINESS modularity table calls this out as mild hardcoding after M-PR6 made seeds/mutators policy-derived.

Why it matters

Non-refund policies still get fitness noise from APR/manager English. Fitness should bias toward AttackFocus tools/args, not demo lexicon.

Proposed direction

Reduce reliance on fixed APR strings: derive optional cues from focus critical args / rule kinds, or narrow premise signal when focus has numeric thresholds. Keep behavior stable enough that existing fitness tests can be adjusted intentionally.

Acceptance criteria

• Hard-coded APR/manager list removed or clearly secondary to AttackFocus signals
• tests/unit/test_fitness.py updated and passing
• No LLM judge

Testing expectations

uv run pytest tests/unit/test_fitness.py -q

Difficulty

M · core