feat: pack-hunt safety + opt-in Kali+ arsenal + capability-approval gate + tester-feedback UX

Adds three coordinated capabilities and tightens two defaults on purpose — this is
safety hardening, NOT a backward-compatible drop-in (see "Tightened defaults").
Fifteen independent adversarial review passes; findings fixed and test-pinned.

- Pack-hunt safety: a strict-majority adjudicator with a comment/string/regex/
  raw-string/heredoc/POD-aware cite-check (language-gated across C/C++/Py/Rust/Go/
  Java/JS/TS/shell/SQL/PHP/Ruby/Perl) so a hallucinated killing-guard can't refute
  a real finding — the cited comparison's operator must match source, and a
  string/regex/heredoc/generic-arglist/template-interpolation is blanked before
  matching. Plus a rate-limit/degraded-health tracker, a global LLM semaphore, and
  a PackBoard with an atomic claim CAS + snapshot-on-emit/clone-on-ingest.
- Opt-in Kali+ arsenal (T3MP3ST_FULL_ARSENAL, OFF by default): 35 default tools
  (31 built-in + 4 external-CLI wrappers) -> 83 with the catalog armed (verify-claims
  CLAIM 4). Most adapters need the underlying binary installed. metasploit / hydra /
  bloodhound are never minted through the generic factory.
- Capability-approval + spicy-action gate for the NEW dangerous arsenal only
  (pre-existing built-ins keep running freely): approve-once, fail-safe deny when
  unattended, redacted audit trail over SSE. T3MP3ST_GATE_BUILTINS=1 extends it to
  the spicy built-in probes. Audit redaction is a pure, unit-tested module.

Tightened defaults (intentional, ON by default — NOT backward-compatible):
- Egress containment: once a mission target is set, built-in networked tools refuse
  off-scope public hosts (not the target/subdomains, not loopback/private) with
  SCOPE DENIED — keeps the agent on authorized scope.
- Role-specialized operator toolkits: each archetype gets a curated default tool
  menu (scanner -> scan tools, exploiter -> sqli/xss/etc). Tools stay registered
  team-wide; the per-role menu is the operator's working set.

UX (from live-tester feedback): a one-click "Approve & run" modal when a standard
Hunt blocks on an external-target receipt (was a dead-end); bounded-parallel
benchmark file ingestion; the deterministic mission-gate chip co-located with the
subjective SITREP pace narration (no more "behind schedule" next to a clean gate);
and click-through finding detail + evidence in the UI (was export-only).

Docs: README + INTEGRITY_LEDGER made re-derivable — honest 35/83 tool count, the
egress-containment default documented, and the Cybench number reconciled to the
single verify-claims-enforced 23/40 = 58% (dropped the stale/uncited 21 and 26).
README voice pass: killed the underselling `Successful Exploits: 0` disqualifier
(read as "never popped anything" — false, given CVE-Zero + the live disclosure
pipeline); swagger now rests on receipts, not vibes. Also corrected the operator
status — the downstream operators run the SAME real tool-backed ReAct loop as
recon (not "orchestration stubs"); the honest limit is that the coordinated swarm
is unproven (single-agent is the benchmarked path), not that they're scaffolding.

Gates: 292 tests, tsc + lint clean, verify-claims 20/20, arsenal:smoke 125/0,
disclosure-CLI self-test 11/11.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/agent/index.ts

@@ -31,6 +31,8 @@ export interface AgentLoopOptions {
   maxTokens?: number;
   /** Tool categories to expose (default: all) */
   toolCategories?: string[];
+  /** Explicit tool-NAME allowlist — the operator's role toolkit. Overrides toolCategories. */
+  tools?: string[];
   /** Whether to include detailed tool output in context (default: true) */
   verboseToolOutput?: boolean;
   /** Max characters per tool result before truncation (default: 4000) */
@@ -91,6 +93,7 @@ export class AgentLoop extends EventEmitter<AgentEvents> {
       maxIterations: options?.maxIterations ?? 15,
       maxTokens: options?.maxTokens ?? 50000,
       toolCategories: options?.toolCategories ?? [],
+      tools: options?.tools ?? [],
       verboseToolOutput: options?.verboseToolOutput ?? true,
       maxToolOutputLength: options?.maxToolOutputLength ?? 4000,
     };
@@ -114,9 +117,11 @@ export class AgentLoop extends EventEmitter<AgentEvents> {
     const seenCalls = new Map<string, string>();
     let noProgress = 0;
 
-    // Get tool definitions from Arsenal
+    // Get tool definitions from Arsenal (the operator's role toolkit: name allowlist wins,
+    // then category filter, then all).
     const toolDefs = this.arsenal.getToolDefinitions(
-      this.options.toolCategories.length > 0 ? this.options.toolCategories : undefined
+      this.options.toolCategories.length > 0 ? this.options.toolCategories : undefined,
+      this.options.tools.length > 0 ? this.options.tools : undefined
     );
 
     // Build initial messages
@@ -308,7 +313,10 @@ export class AgentLoop extends EventEmitter<AgentEvents> {
       // A bad/hallucinated tool name must NOT crash the loop. Return the callable set so the
       // model self-corrects in-place instead of dying or looping on a tool that doesn't exist.
       const available = this.arsenal
-        .getToolDefinitions(this.options.toolCategories.length ? this.options.toolCategories : undefined)
+        .getToolDefinitions(
+          this.options.toolCategories.length ? this.options.toolCategories : undefined,
+          this.options.tools.length ? this.options.tools : undefined
+        )
         .map((t) => t.name);
       toolResult = {
         success: false,