Make prepended history normalization capability-driven

[rlundeen2]

This PR updates Roman's romanlutz-fix-converter-scoping-692 branch. It keeps prepended conversations structured in PyRIT memory and adapts them only in the target-facing send path.

Changes from Roman's branch

• Registers EDITABLE_HISTORY in the target normalization pipeline instead of handling non-chat targets in individual attacks.
• Uses TargetNormalizationContext to identify the explicit persisted seed boundary. Stateful targets consume it after the first provider attempt; stateless targets reuse the original seed for each current request.
• Uses the shared HistorySquashNormalizer for target-facing history adaptation instead of attack-specific flattening implementations.
• Makes PrependedConversationConfig shared attack policy on AttackStrategy and resolves its per-send override through a shared base helper.
• Includes the converter role scope in the attack identifier and the configured prepended-history formatter as a child identifier. Formatter-specific settings therefore affect resume and evaluation identity.
• Lets technique factories specify PrependedConversationConfig through attack_kwargs; all attacks that create or accept prepended conversations expose the parameter, including SkeletonKey.
• Applies the shared path to PromptSending, RedTeaming, Crescendo, MultiPromptSending, ChunkedRequest, TAP/PAIR, SkeletonKey, and BargeIn.
• Keeps structured memory as the canonical conversation. A target without editable history may receive one flattened prompt while memory still shows the original structured turns.
• Preserves the original TAP seed boundary when branches are copied; copied live turns do not become new seed history.
• Reads feedback scores only from the final prepended assistant turn.
• Warns when native non-text history must become a text placeholder for a target without editable history.
• Keeps detailed normalization lifecycle documentation with message normalizers and limits framework.md to architecture and component responsibilities.

Compatibility note

The prepended-conversation policy now contributes to the attack evaluation hash. Existing cached evaluation results created with the old identifier will not match the new identifier.

Validation

• 149 focused attack, target-normalization, score, and technique regression tests passed after rebasing onto the latest PR head.
• Ruff and scoped ty checks passed.