Add AG034 (cloud/infra destruction) + AG035 (money movement) (0.16.0)

[autonomyproof]

Extend the AG033 model — an agent tool doing an irreversible, high-impact action with no approval — into two new domains, via a shared _iter_tool_sinks spine.

AG034 — Cloud/infrastructure destruction exposed to the agent:
AWS terminate_instances / delete_bucket / delete_db_instance / delete_cluster /
delete_stack / delete_volume / delete_file_system / delete_nodegroup, and Kubernetes
delete_namespaced_* / delete_collection_* / delete_namespace. MITRE T1485 + T1531.

AG035 — Money movement exposed to the agent without approval:
Refund.create / Payout.create / Transfer.create (Stripe-style), whether qualified
(stripe.Refund.create) or imported (Refund.create). The prompt-injection payout attack.

Both are call-based and tool-scoped with approval suppression, so they stay zero-FP:
Customer.create, single-message delete_message, non-tool functions, and approval-gated
tools all stay silent. Refactored AG033 onto the shared spine (behavior unchanged);
unified approval detection to substring match (catches approved/is_approved/needs_approval).

Verification:

• Ground-truth corpus: 136 cases, precision 1.000 / recall 1.000 (adds 9 AG034/AG035 cases).
• Real-repo benchmark: 0 findings for each across 40+ repos — zero false positives.
• 551 tests, 100% branch coverage, ruff + ruff format + mypy all clean.

Bumps 0.15.0 -> 0.16.0; updates CHANGELOG + README catalogue.

What this changes

Checklist

• Commits are signed off (git commit -s) — required by CI (DCO)
• pytest passes (100% branch coverage is enforced)
• ruff check . and ruff format --check . pass
• mypy passes

If this adds or changes a detection rule

• Added a positive test (the rule fires) and a negative test (it does not)
• Added a positive and negative case to benchmark/corpus.yaml
• Ran python benchmark/run.py and confirmed no new false positives on the real-repo corpus
• Registered the rule in rules/registry.py and added standards mappings