fix(redteam): separate errored attacks from breaches in ASR

[kevmyung]

Description

When a red team attack fails for infrastructure reasons — the target crashes, or the AttackSuccessEvaluator judge itself errors — the base Experiment isolates it as test_pass=False, score=0. The red team report read test_pass=False as a breach, so infrastructure failures were counted as attack success and inflated the ASR (n_breached / total), with no way to tell a real breach from a broken run.

Adds a third state alongside breached/defended: errored, excluded from the breach count and the ASR denominator (breached / (total - errored)).

• task.py catches non-throttling exceptions from strategy.run_attack, flags the case as errored in run metadata, and returns empty output so the judge scores nothing. Throttling errors are re-raised so the base Experiment's retry/backoff is unchanged.
• report.py adds AttackResult.errored and a state property (breached/defended/errored). Judge failures reach the report only as base-recorded error reasons, so those reason prefixes are also treated as errored. The matrix, per-attack rows, and summary render errored distinctly and drop it from ASR.

Scope is experimental/redteam/{task.py, report.py} only — no base or public API change.

Related Issues

Closes #295

Documentation PR

N/A

Type of Change

Bug fix

Testing

• I ran hatch run prepare

hatch run prepare passes end to end: ruff clean, mypy clean, full suite green across the Python version matrix (1670 passed each). New tests cover the task-runner error isolation and throttling re-raise, plus errored-state detection and ASR exclusion in the report.

Checklist

• I have read the CONTRIBUTING document
• I have reviewed and understand every line of code in this PR, including any generated by AI tools, and I can explain why it works
• My change is focused and reasonably small; I have split unrelated work into separate PRs
• I have added any necessary tests that prove my fix is effective or my feature works
• I have updated the documentation accordingly
• I have added an appropriate example to the documentation to outline the feature, or no new docs are needed
• My changes generate no new warnings
• Any dependent changes have been merged and published

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.