When the objective target returns non-text content (images, video, etc.),
the adversarial chat now receives a multimodal message containing both
the scorer's textual feedback AND the actual generated media. This enables
vision-capable adversarial LLMs (e.g. GPT-4o) to see what the target
produced and craft more informed follow-up prompts.

Changes:
- _handle_adversarial_file_response: returns (feedback_text, media_piece)
  tuple instead of just the feedback string
- _build_adversarial_prompt: returns Union[str, tuple] to propagate media
- _generate_next_prompt_async: constructs multimodal Message with text +
  media pieces when file response detected; text-only path unchanged

Tests:
- Updated 2 existing tests for new tuple return type
- Added 5 new tests in TestMultimodalFeedbackLoop:
  - image response produces multimodal message to adversarial chat
  - video response produces multimodal message to adversarial chat
  - text response stays text-only (no regression)
  - _build_adversarial_prompt returns tuple for image
  - _build_adversarial_prompt returns str for text

Co-authored-by: Roman Lutz <[email protected]>

Address Roman's feedback items #2 and #3:
- Change _build_adversarial_prompt to return Message instead of Union type
- Extract message construction logic into separate helper methods
- Add _build_text_message() for simple text prompts
- Add _build_multimodal_message() for media responses
- Simplify caller code by removing tuple handling logic
- Improve logging to work with Message objects

These architectural improvements prepare the code to integrate with
the modality support detection system from separate PR.

The objective target's TargetCapabilities are now the single source of truth
for whether prior media (image, audio, video) is forwarded between the
adversarial chat and the objective target across all multi-turn attacks.

A shared ModalityFeedbackRouter is composed into RedTeamingAttack,
CrescendoAttack, TreeOfAttacksWithPruningAttack, and PAIRAttack. It decides
per turn whether to attach prior response media on either side based on each
target's declared input_modalities, and fills MessagePiece.adversarial_placeholder()
slots in AttackParameters.next_message so callers can mix seed media (e.g. a
base image to edit) with adversarial-generated text on turn 1.

Three usage scenarios fall out naturally:

* default (target advertises text-to-image and text+image-to-image):
  turn 1 sends text only, turns 2+ pass the previous image back along with
  adversarial text;
* text-to-image only (narrow the target's input_modalities via custom_configuration):
  every turn is text-only;
* image-editing only (narrow the target's input_modalities to text+image, pass
  next_message=Message([MessagePiece.adversarial_placeholder(), seed_image])):
  turn 1 sends adversarial text plus seed, turns 2+ refine the previous image.

Same logic is generic across image_path / audio_path / video_path.

Notes:
* The PR branch's history was disjoint from current origin/main (an orphaned
  past commit). Branch was reset to origin/main and the feature rebuilt on
  top; the prior PR-only red_teaming helpers are superseded by the router,
  and the prior changes to refusal scorer YAMLs / video target / message.py
  are already in main via separate merges.
* TreeOfAttacksWithPruningAttack._TreeOfAttacksNode.last_response widens from
  Optional[str] to Optional[Message] so the router can introspect the
  data_type of prior pieces; readers were updated accordingly.

Co-authored-by: Copilot <[email protected]>

- Reset doc/ to match origin/main (flat numbered notebook structure)

- Remove old attack/, workflow/, benchmark/, promptgen/ subdirectory notebooks

- Add doc/code/executor/8_modality_feedback.py/.ipynb: two-seed Crescendo

  modality-feedback example (roakey + sailboat, hybrid capability profile)

- Update 0_executor.md and myst.yml to include notebook microsoft#8 in navigation

Co-authored-by: Copilot <[email protected]>

Co-authored-by: Copilot <[email protected]>