feat: toxicity penalty tests — Phase 2 benchmark honesty - #10

Phase 2: Toxicity penalty — predicted hemolytic/toxic candidates are down-ranked.

- Add test_toxicity_penalty.py: 13 tests covering the full toxicity penalty mechanism:
  Safety scorer penalty signals:
  - Hydrophobic fraction > 0.65 → hemolysis proxy penalty
  - Charge density > 0.55 → toxicity proxy penalty
  - Length > 35 aa → stability and synthesis penalty
  - Cysteine fraction > 0.25 → disulfide complexity penalty
  - Longest repeat run ≥ 6 → degenerate composition penalty

  Tests verify:
  - Extreme hydrophobicity reduces safety score (<0.6)
  - Extreme charge density reduces safety score (<0.6)
  - High cysteine fraction reduces safety (<0.9)
  - Very long sequences penalized
  - Long repeat runs penalized
  - All balanced AMP candidates score higher safety than poly-hydrophobic sequences
  - All balanced AMP candidates score higher safety than poly-cationic sequences
  - Monotonic safety reduction with increasing excess hydrophobicity
  - Double penalty (charge + repeat run) on poly-K
  - Mean AMP ensemble > mean high-risk ensemble in full pipeline
  - All AMPs outrank all high-risk candidates
  - Toxicity penalty propagates correctly through pipeline safety field
  - High-risk candidates excluded with strict max_safety_risk filter
- Fix ruff F401 unused imports (pipeline.py, test_cli.py, test_pipeline_filters.py)
- 50 tests passing, ruff clean