FEAT: deprecate raise in PrependedConversationConfig

[hannahwestra25]

Simplify PrependedConversationConfig: deprecate raise-on-non-chat-target

Why

ConversationManager already has a capability-driven path that normalizes a prepended conversation into the first turn when the target lacks EDITABLE_HISTORY. The legacy non_chat_target_behavior="raise" knob (and its default() / for_non_chat_target() factories) are a parallel, weaker enforcement mechanism that predates that routing and doesn't compose with TargetCapabilities / CapabilityHandlingPolicy. This PR collapses that surface so non-chat targets have one consistent answer: normalize.

What changes

• PrependedConversationConfig(non_chat_target_behavior="raise") → emits DeprecationWarning (still raises this release).
• PrependedConversationConfig.default() → emits DeprecationWarning (still returns a "raise" config).
• PrependedConversationConfig.for_non_chat_target() → emits DeprecationWarning (equivalent to the default constructor).
• ValueError text on the "raise" path updated to call out the deprecation and the 0.16.0 behavior change. Misleading "configure TargetCapability" guidance removed.
• Tests updated to assert the new warnings.

All three removals target 0.16.0.

Behavior changes

• This release: none. Only DeprecationWarnings added.
• In 0.16.0: non-chat targets will always normalize. "raise" and the two factories will be removed. There is no direct replacement for "raise" — callers that need strict enforcement should pre-check the capability:

  from pyrit.prompt_target import CapabilityName
  if not target.configuration.includes(capability=CapabilityName.EDITABLE_HISTORY):
      raise ValueError("This attack requires a target with editable multi-turn history.")

  Routing this through CapabilityHandlingPolicy was considered but rejected: EDITABLE_HISTORY is intentionally not policy-addressable.

Why PrependedConversationConfig is kept

The class still owns two real, caller-facing knobs with no other home:

• apply_converters_to_roles — selects which roles get request converters applied.
• message_normalizer — overrides the MessageStringNormalizer used for non-chat normalization.

Both are exposed via PromptSendingAttack, CrescendoAttack, and TreeOfAttacksAttack. Once non_chat_target_behavior and the deprecated factories are gone in 0.16.0, the class will have a much smaller surface and could reasonably be renamed or folded into per-attack configs — deferred as future work.

Tests and Documentation

• 83/83 tests pass in the two affected test files; new tests cover all three deprecations and assert no warning is emitted on the default constructor path.
• Fully backwards compatible. No production callers, notebooks, or docs reference the deprecated APIs (verified via grep).

[rlundeen2]

Approved; but I also wonder if there are better ways to do the remaining functionality now. like converterConfig (for apply_converters_to_roles) and adding message normalizers to targets as we go

[hannahwestra25]

Approved; but I also wonder if there are better ways to do the remaining functionality now. like converterConfig (for apply_converters_to_roles) and adding message normalizers to targets as we go

yeah I think this piece is confusing with the target normalization and should be re-thought a bit / should be more streamlined. I created a follow up work item to fully deprecate this / rethink this class.