Models know when they're reward hacking – and we can catch them at scale