[Dmujt]

Summary

This PR adds the released H-MARL Expert and Meta Blue policies from Singh et al. (arXiv:2410.17351). They are evaluation-only baselines that run in JAX, and nothing here trains H-MARL. It also adds the paper's three FSM Red variants. The cotraining recipes now run those Reds after training, plus FSM/CIA checkpoint curves.

Pretrained H-MARL blues

• pretrained/hmarl_import.py downloads the released h-marl-3policy iter_49 actors from a pinned upstream commit and checks their SHA-256 hashes. It loads the weights with a restricted unpickler and converts them to .cache/pretrained/hmarl/actors.safetensors.
• pretrained/hmarl.py and hmarl_eval.py run JAX inference for both variants:
  • Meta uses its learned two-action master policy.
• Adds recipes/hmarl/hmarl_{expert,meta}.yaml (kind: pretrained_eval) and scripts/eval/eval_hmarl.py.
  • The protocol matches the cotraining_lstm_env_diversity scripted sweep: 10 held-out topologies × 10 seeds × 6 episodes, 500 steps each, with fixed CIA roles.

Shared IOC memory and enhanced observations from the hmarl paper

• New blue_ioc.py keeps per-host process, network, file and decoy IOC history, and Recover clears it. Each sender shares one host reference per step, delivered the next step, which matches H-MARL's messaging bandwidth. It uses only evidence Blue actually observed, never Red session state.
• Adds decoy-connection telemetry (decoy_telemetry.py, blue_monitor.py, blue_restore.py).
• cage4_enhanced_obs: true now selects the v2 layout: 450 inputs, one more 48-slot host block than v1.
  • Sidecars record run.blue_observation_version.
  • Existing enhanced checkpoints still load as v1.

H-MARL paper Reds

• Adds the aggressive, stealthy and impact reds in JAX (scenarios/cc4/hmarl_reds.py, red_selectors.py) and in CybORG (cyborg_hmarl_agents.py) from the original HMARL paper
• scripts/eval/eval_hmarl_reds.py runs these HARML paper reds against any final blue

Cotraining evaluation changes

• The IPPO, IPPO-LSTM, MAPPO and MAPPO-LSTM recipes, in both standard and env-diversity versions, gain an hmarl-reds post-training eval.
• checkpoint_scripted_reds is now enabled and required. It evaluates FSM/CIA every X steps and on the final run
• Cross-play over training history now includes the exact final bundle (include_final, via with_final_checkpoint).
• The env-diversity recipes add a nondiverse-red option to eval the diverse-trained blue seed counterpart on the non-diverse-trained red.