FEAT: Define GCG extension protocols (typing surface only)

[romanlutz]

Summary

Adds pyrit/auxiliary_attacks/gcg/extension_protocols.py containing four runtime_checkable Protocol classes that mark the algorithmic seams in the GCG optimization loop where a future caller may substitute custom behavior:

• SamplingStrategy — how candidate suffix token sequences are proposed from the gradient. Current implementation: top-k by -grad, uniform pick within top-k (GCGPromptManager.sample_control).
• LossFunction — how candidate suffixes are scored against the target. Current implementation: weighted cross-entropy on target + control slices.
• CandidateFilter — how proposed candidates get pruned before evaluation. Current implementation: drops candidates whose decoded string re-tokenizes to a different token count (MultiPromptAttack.get_filtered_cands).
• SuffixInitializer — how the initial suffix string is constructed. Current implementation: literal string from GCGAlgorithmConfig.control_init.

Each protocol has a Google-style docstring with Args: / Returns: and a References: section pointing at the symbols in gcg_attack.py / attack_manager.py it abstracts.

What this PR is not

Pure typing surface — zero behavior change, zero wiring. No concrete implementations of the protocols, no new fields on GCGAlgorithmConfig, no dispatch in GCGMultiPromptAttack. The protocols are exposed so users can implement them; consuming them is left for follow-up work.

Design notes

• Protocol parameter names use fully spelled-out tokens (control_tokens, non_ascii_tokens, top_k, temperature, token_ids) rather than mirroring the legacy abbreviations.
• The module uses from __future__ import annotations plus a TYPE_CHECKING import for torch so it imports cleanly on installs that only have the base dev extra (no torch), preserving the invariant introduced by commit 36aaaa31 from FEAT: GCG public API - GCG + GCGConfig + ExperimentalWarning, shifts module to experimental status #1792.
• All four protocols are re-exported from pyrit.auxiliary_attacks.gcg via the existing PEP 562 _LAZY_IMPORTS pathway so the public surface stays consistent with how GCG / GCGGenerator / GCGContext / GCGResult are exposed.
• LossFunction owns its entire loss computation (criterion choice, slicing, and any weighted combination of target/control terms). The current target_weight / control_weight knobs on GCGAlgorithmConfig keep working unchanged.

Drive-by cleanups (in response to review feedback)

• GCGAlgorithmConfig.temp is widened from int = 1 to float = 1.0 and the same change is propagated to GCGPromptManager.sample_control, GCGMultiPromptAttack.step, and MultiPromptAttack.run — the other two strategy run overloads were already float, so this also resolves a pre-existing inconsistency. Module is experimental, no deprecation cycle.
• Seven Sphinx reST cross-reference roles (:class:, :meth:, :func:) in config.py are replaced with plain double-backtick code spans, since PyRIT renders docstrings with MyST and the check-no-rest-roles pre-commit hook now blocks them.

Tests

New tests/unit/auxiliary_attacks/gcg/test_extension_protocols.py with 19 parametrized test instances covering:

• Module __all__ contents.
• Package re-export identity (each name imported from the package root is the same object as the one in extension_protocols).
• Each protocol is @runtime_checkable.
• Each protocol accepts a minimal in-test concrete implementation via isinstance(impl, ProtocolName).
• A class missing every method fails the isinstance check for each protocol (catches accidental signature drift in future PRs).
• One return-shape smoke test per protocol with a trivial stub implementation.

Gated with pytest.importorskip("torch") since the stubs construct real torch.Tensor arguments for the shape assertions.

Full GCG unit suite still passes: 133/133 in tests/unit/auxiliary_attacks/gcg/.