feat: pack-hunt safety + opt-in Kali+ arsenal + capability-approval gate + tester-feedback UX

Adds three coordinated capabilities and tightens two defaults on purpose — this is
safety hardening, NOT a backward-compatible drop-in (see "Tightened defaults").
Fifteen independent adversarial review passes; findings fixed and test-pinned.

- Pack-hunt safety: a strict-majority adjudicator with a comment/string/regex/
  raw-string/heredoc/POD-aware cite-check (language-gated across C/C++/Py/Rust/Go/
  Java/JS/TS/shell/SQL/PHP/Ruby/Perl) so a hallucinated killing-guard can't refute
  a real finding — the cited comparison's operator must match source, and a
  string/regex/heredoc/generic-arglist/template-interpolation is blanked before
  matching. Plus a rate-limit/degraded-health tracker, a global LLM semaphore, and
  a PackBoard with an atomic claim CAS + snapshot-on-emit/clone-on-ingest.
- Opt-in Kali+ arsenal (T3MP3ST_FULL_ARSENAL, OFF by default): 35 default tools
  (31 built-in + 4 external-CLI wrappers) -> 83 with the catalog armed (verify-claims
  CLAIM 4). Most adapters need the underlying binary installed. metasploit / hydra /
  bloodhound are never minted through the generic factory.
- Capability-approval + spicy-action gate for the NEW dangerous arsenal only
  (pre-existing built-ins keep running freely): approve-once, fail-safe deny when
  unattended, redacted audit trail over SSE. T3MP3ST_GATE_BUILTINS=1 extends it to
  the spicy built-in probes. Audit redaction is a pure, unit-tested module.

Tightened defaults (intentional, ON by default — NOT backward-compatible):
- Egress containment: once a mission target is set, built-in networked tools refuse
  off-scope public hosts (not the target/subdomains, not loopback/private) with
  SCOPE DENIED — keeps the agent on authorized scope.
- Role-specialized operator toolkits: each archetype gets a curated default tool
  menu (scanner -> scan tools, exploiter -> sqli/xss/etc). Tools stay registered
  team-wide; the per-role menu is the operator's working set.

UX (from live-tester feedback): a one-click "Approve & run" modal when a standard
Hunt blocks on an external-target receipt (was a dead-end); bounded-parallel
benchmark file ingestion; the deterministic mission-gate chip co-located with the
subjective SITREP pace narration (no more "behind schedule" next to a clean gate);
and click-through finding detail + evidence in the UI (was export-only).

Docs: README + INTEGRITY_LEDGER made re-derivable — honest 35/83 tool count, the
egress-containment default documented, and the Cybench number reconciled to the
single verify-claims-enforced 23/40 = 58% (dropped the stale/uncited 21 and 26).
README voice pass: killed the underselling `Successful Exploits: 0` disqualifier
(read as "never popped anything" — false, given CVE-Zero + the live disclosure
pipeline); swagger now rests on receipts, not vibes. Also corrected the operator
status — the downstream operators run the SAME real tool-backed ReAct loop as
recon (not "orchestration stubs"); the honest limit is that the coordinated swarm
is unproven (single-agent is the benchmarked path), not that they're scaffolding.

Gates: 292 tests, tsc + lint clean, verify-claims 20/20, arsenal:smoke 125/0,
disclosure-CLI self-test 11/11.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/operators/index.ts

@@ -73,7 +73,7 @@ export const ARCHETYPE_PROFILES: Record<OperatorArchetype, ArchetypeProfile> = {
     description: 'Specialized in OSINT, network discovery, and asset enumeration',
     mitreTactics: ['TA0043'],
     primaryPhases: [KillChainPhase.RECON],
-    defaultTools: ['nmap_scan', 'port_scan', 'dns_lookup', 'subdomain_enum', 'whois_lookup', 'reverse_dns', 'technology_detect'],
+    defaultTools: ['dns_lookup', 'reverse_dns', 'whois_lookup', 'subdomain_enum', 'nmap_scan', 'port_scan', 'network_trace', 'version_detect', 'robots_txt_fetch', 'cidr_expand', 'technology_detect', 'http_request', 'curl_request', 'header_analysis', 'api_endpoint_discovery'],
     toolCategories: ['recon', 'web'],
     capabilities: ['osint', 'dns_enum', 'subdomain_discovery', 'port_scanning', 'service_detection'],
     techniques: ['T1595', 'T1592', 'T1589', 'T1590', 'T1591'],
@@ -84,7 +84,7 @@ export const ARCHETYPE_PROFILES: Record<OperatorArchetype, ArchetypeProfile> = {
     description: 'Identifies vulnerabilities and security misconfigurations',
     mitreTactics: ['TA0007'],
     primaryPhases: [KillChainPhase.WEAPONIZE],
-    defaultTools: ['nuclei_scan', 'ssl_scan', 'cors_check', 'csp_analysis', 'header_analysis', 'http_methods_test', 'api_endpoint_discovery'],
+    defaultTools: ['nuclei_scan', 'ssl_scan', 'cors_check', 'csp_analysis', 'clickjacking_test', 'cookie_analysis', 'http_methods_test', 'open_redirect_test', 'port_scan', 'version_detect', 'technology_detect', 'api_endpoint_discovery', 'header_analysis', 'http_request', 'curl_request'],
     toolCategories: ['vuln', 'web', 'recon'],
     capabilities: ['vuln_scanning', 'web_scanning', 'service_enum', 'config_audit'],
     techniques: ['T1046', 'T1082', 'T1083', 'T1087'],
@@ -95,7 +95,7 @@ export const ARCHETYPE_PROFILES: Record<OperatorArchetype, ArchetypeProfile> = {
     description: 'Executes exploits and achieves initial access',
     mitreTactics: ['TA0001', 'TA0002'],
     primaryPhases: [KillChainPhase.DELIVER, KillChainPhase.EXPLOIT],
-    defaultTools: ['sqli_scan', 'xss_scan', 'ssti_test', 'lfi_test', 'open_redirect_test', 'ffuf_fuzz', 'dir_bruteforce', 'http_request'],
+    defaultTools: ['sqli_scan', 'xss_scan', 'ssti_test', 'lfi_test', 'open_redirect_test', 'nuclei_scan', 'ffuf_fuzz', 'dir_bruteforce', 'api_endpoint_discovery', 'http_methods_test', 'password_spray', 'hash_crack', 'base64_decode', 'url_encode', 'jwt_decode', 'http_request', 'curl_request', 'technology_detect', 'header_analysis'],
     toolCategories: ['vuln', 'web', 'auth', 'util'],
     capabilities: ['exploit_dev', 'payload_delivery', 'initial_access', 'code_execution'],
     techniques: ['T1190', 'T1133', 'T1078', 'T1059'],
@@ -106,7 +106,7 @@ export const ARCHETYPE_PROFILES: Record<OperatorArchetype, ArchetypeProfile> = {
     description: 'Moves through networks and escalates privileges',
     mitreTactics: ['TA0008', 'TA0004'],
     primaryPhases: [KillChainPhase.INSTALL],
-    defaultTools: ['hash_crack', 'password_spray', 'jwt_decode', 'http_request'],
+    defaultTools: ['hash_crack', 'password_spray', 'jwt_decode', 'cookie_analysis', 'dns_lookup', 'port_scan', 'subdomain_enum', 'network_trace', 'nmap_scan', 'sqli_scan', 'lfi_test', 'cve_lookup', 'base64_decode', 'http_request', 'curl_request', 'technology_detect'],
     toolCategories: ['recon', 'web', 'auth', 'vuln'],
     capabilities: ['priv_esc', 'lateral_movement', 'credential_access', 'domain_enum'],
     techniques: ['T1021', 'T1078', 'T1068', 'T1548'],
@@ -117,7 +117,7 @@ export const ARCHETYPE_PROFILES: Record<OperatorArchetype, ArchetypeProfile> = {
     description: 'Collects and extracts sensitive data',
     mitreTactics: ['TA0009', 'TA0010'],
     primaryPhases: [KillChainPhase.ACTIONS],
-    defaultTools: ['http_request', 'curl_request', 'api_endpoint_discovery'],
+    defaultTools: ['http_request', 'curl_request', 'api_endpoint_discovery', 'dir_bruteforce', 'base64_decode', 'url_encode', 'jwt_decode', 'cookie_analysis', 'subdomain_enum', 'robots_txt_fetch', 'technology_detect', 'lfi_test', 'sqli_scan', 'header_analysis', 'cve_lookup'],
     toolCategories: ['web', 'recon', 'util'],
     capabilities: ['data_collection', 'exfiltration', 'staging', 'compression'],
     techniques: ['T1041', 'T1048', 'T1567', 'T1560'],
@@ -128,7 +128,7 @@ export const ARCHETYPE_PROFILES: Record<OperatorArchetype, ArchetypeProfile> = {
     description: 'Establishes persistence and covers tracks',
     mitreTactics: ['TA0003', 'TA0005'],
     primaryPhases: [KillChainPhase.INSTALL, KillChainPhase.C2],
-    defaultTools: ['http_request', 'header_analysis', 'cookie_analysis', 'clickjacking_test'],
+    defaultTools: ['http_request', 'curl_request', 'cookie_analysis', 'header_analysis', 'csp_analysis', 'clickjacking_test', 'technology_detect', 'http_methods_test', 'jwt_decode', 'base64_decode', 'url_encode', 'robots_txt_fetch', 'subdomain_enum', 'open_redirect_test', 'ssl_scan'],
     toolCategories: ['web', 'recon', 'vuln'],
     capabilities: ['persistence', 'evasion', 'cleanup', 'anti_forensics'],
     techniques: ['T1547', 'T1053', 'T1136', 'T1070'],
@@ -139,8 +139,8 @@ export const ARCHETYPE_PROFILES: Record<OperatorArchetype, ArchetypeProfile> = {
     description: 'Orchestrates operations and manages agents',
     mitreTactics: ['TA0011'],
     primaryPhases: [KillChainPhase.C2],
-    defaultTools: ['cve_lookup', 'technology_detect'],
-    toolCategories: ['recon', 'web'],
+    defaultTools: ['cve_lookup', 'technology_detect', 'http_request', 'curl_request', 'header_analysis', 'nmap_scan', 'port_scan', 'dns_lookup', 'subdomain_enum', 'nuclei_scan', 'sqli_scan', 'api_endpoint_discovery', 'version_detect', 'ssl_scan'],
+    toolCategories: ['recon', 'web', 'vuln'],
     capabilities: ['orchestration', 'task_management', 'communication', 'decision_making'],
     techniques: ['T1071', 'T1095', 'T1573', 'T1132'],
     systemPrompt: OPERATOR_SYSTEM_PROMPTS.coordinator,
@@ -150,8 +150,8 @@ export const ARCHETYPE_PROFILES: Record<OperatorArchetype, ArchetypeProfile> = {
     description: 'Analyzes findings and generates reports',
     mitreTactics: [],
     primaryPhases: [KillChainPhase.ACTIONS],
-    defaultTools: ['cve_lookup', 'jwt_decode', 'hash_crack', 'technology_detect'],
-    toolCategories: ['web', 'vuln', 'recon'],
+    defaultTools: ['cve_lookup', 'jwt_decode', 'hash_crack', 'base64_decode', 'url_encode', 'technology_detect', 'ssl_scan', 'header_analysis', 'cors_check', 'csp_analysis', 'cookie_analysis', 'whois_lookup', 'dns_lookup', 'http_request', 'curl_request'],
+    toolCategories: ['web', 'vuln', 'recon', 'util'],
     capabilities: ['analysis', 'reporting', 'recommendations', 'risk_assessment'],
     techniques: [],
     systemPrompt: OPERATOR_SYSTEM_PROMPTS.analyst,