[BREAKING] FEAT: Restructure Psychosocial scenario for per-subharm scoring

[varunj-msft]

Description

Restructures the Psychosocial scenario so strategies are techniques and subharms are datasets. Started as the --max-dataset-size fast-path bugfix and grew into the full standardization Rich sketched in review.

1. Strategies are techniques now. The strategy enum is prompt_sending, role_play, crescendo instead of the old subharm-as-strategy anti-pattern. Subharm selection moves off --strategies and onto --dataset-names.

2. Seed file split per subharm. psychosocial.prompt becomes airt_imminent_crisis.prompt + airt_licensed_therapist.prompt, each carrying its own scorer rubric and crescendo escalation prompt. This removes runtime harm-filtering entirely — there's no longer a cap-vs-filter ordering to get wrong, which is what made --max-dataset-size 1 fail before.

3. Per-subharm scorers. One FloatScaleThresholdScorer is built per subharm and routed to both the AtomicAttack and the technique's AttackScoringConfig, so running all no longer scores attacks with the wrong rubric.

4. Per-subharm baselines. Via a generalized base-class mechanism. Baseline identity now lives on the model: AtomicAttack gains an is_baseline flag, and the central baseline rescue in Scenario.initialize_async checks any(aa.is_baseline for aa in self._atomic_attacks) instead of matching the literal name "baseline". MatrixAtomicAttackBuilder gains a BaselineSpec dataclass and a plural _build_baseline_atomic_attacks helper. Psychosocial uses this to emit one baseline per subharm (baseline_imminent_crisis / baseline_licensed_therapist), each carrying that subharm's scorer and display group, so the two no longer collide on a shared "baseline" key. Foundry's red_team_agent.py bare composite (no attack, no converters) is flagged is_baseline so it is likewise recognized and not double-prepended.

5. initialize_async validates dataset names. A user-supplied dataset_config is allowed only if its dataset names are a subset of the subharms, so --max-dataset-size N still works while custom names are rejected with a clear error.

Crescendo is kept out of the default aggregate (opt-in via --strategies all / --strategies crescendo) since it's the heaviest technique — default runs are single-turn. BASELINE_ATTACK_POLICY is back to Enabled, and VERSION is bumped 2→3 because the default behavior changed; stored v2 results raise cleanly on --resume rather than silently mixing semantics.

One deliberate divergence from the review sketch, flagged inline: TARGET_REQUIREMENTS is left at the base default rather than EDITABLE_HISTORY. With Crescendo opt-in, the default run is single-turn, and requiring editable history at the scenario level would reject OpenAIChatTarget before the strategy resolves. Crescendo enforces that requirement itself when it runs. Easy to flip back if preferred.

Tests and Documentation

Reworked tests/unit/scenario/airt/test_psychosocial.py around the new shape — 27 tests across 6 classes:

• TestPsychosocialStrategyEnum / TestPsychosocialTechniques — enum members, default tags, Crescendo excluded from default
• TestSubharmConfigs — both subharms wired with the right dataset, scorer prompt, and crescendo path
• TestPsychosocialInitialization — VERSION == 3, baseline policy
• TestPsychosocialDatasetConfigValidation — max_dataset_size=1 on a valid subharm doesn't raise; custom / unknown names do
• TestPsychosocialCrossProduct — (technique × subharm) atomic attacks with correct names, per-subharm scorer routing, and per-subharm baselines

This PR also generalizes baseline handling in shared infrastructure (pyrit/scenario/core/atomic_attack.py, matrix_atomic_attack_builder.py, scenario.py) and updates Foundry (pyrit/scenario/scenarios/foundry/red_team_agent.py), with a regression test tests/unit/scenario/foundry/test_red_team_agent.py::test_bare_composite_baseline_not_double_prepended.

Validation:

• pytest tests/unit/scenario/airt/test_psychosocial.py → 27 passed
• pytest tests/unit/scenario/ (full scenario suite) → all passing, no regressions
• ruff check + ruff format --check + ty → all clean

[varunj-msft]

Pushed the restructure. Only open question is TARGET_REQUIREMENTS (in the refactor thread). Also retitling since this isn't a bugfix anymore

[rlundeen2]

Maybe we should hold off until the DataConfiguration refactor is in

[varunj-msft]

Unblocked now - the DataConfiguration refactor (#2071/#2100) is merged and I've rebased on top, so this is ready for another pass!

[rlundeen2]

The scenario doesn't use the new patterns. It predates the refactor.

ScenarioContext.seed_groups_by_dataset does do what I asked for, but the issue is solved upstream.

1. The subharms diverged (the strategies are the subharms)
2. The techniques are probably poor fits. E.g. Roleplay Movie script is probably not the right strategy to test for licenced therapist; and success is measuring the wrong thing.
3. There are some big conflict hunks if you try to merge main (because it's using the old patterns).

I might build on top of main, and get rid of this branch. Keep some ideas here (per-subharm scorer + crescendo path, per-subharm baseline naming) but express them via _build_atomic_attacks_async(context), seed_groups_by_dataset, central baseline, and subharm-aware technique selection (dropping role_play for licensed_therapist).