ZugaShield

## What <!-- Brief description of the change --> ## Why <!-- What problem does this solve? Link issues with "Fixes #123" --> ## How to test - [ ] All existing tests pass (`python -m pytest tests/ -v`) - [ ] New tests added for new functionality - [ ] `ruff check` and `ruff format --check` pass ## Checklist - [ ] No new dependencies added (or added as optional extra) - [ ] Detection changes include test cases for both positive and negative - [ ] Signature changes include example payloads in the PR description