feat: cloud / mobile / binary-RE offensive loadouts (arsenal + detection benchmarks)

Three new category loadouts, each = arsenal + an offline-scorable benchmark, opt-in and
honestly scoped (roster marks all 🚧; pacu/frida stay catalog_only, unit-tested non-mintable):
- cloud: aws/az/gcloud + scoutsuite/cloudfox/pmapper; cloud:bench IaC-misconfig detection
- mobile: apkleaks/mobsfscan/drozer/objection/class-dump; mobile:bench static ruleset
- binary/RE: ghidra/objdump/checksec/strings/readelf/gdb; binary:bench decompiled-sink detector

Mobile/binary benches are DETECTOR REGRESSION CHECKS (rules+fixtures co-authored — a pass is a
floor, not a detection rate). No new headline numbers; verify-claims 24/24.

tsc clean; 337 tests; lint 0 errors.

bench/cloud-misconfig/sample-checkov-output.json

@@ -0,0 +1,13 @@
+{
+  "_note": "A committed, representative `checkov -o json` result over the corpus fixtures, used by --self-test to validate the parser + scorer OFFLINE (checkov need not be installed). The secure control trips only a benign logging check (CKV_AWS_18), NOT any target misconfig check — so discrimination must pass.",
+  "results": {
+    "failed_checks": [
+      { "check_id": "CKV_AWS_20", "file_path": "/s3-public-acl.tf", "resource": "aws_s3_bucket.public", "severity": "HIGH" },
+      { "check_id": "CKV_AWS_24", "file_path": "/sg-open-ssh.tf", "resource": "aws_security_group.ssh", "severity": "HIGH" },
+      { "check_id": "CKV_AWS_16", "file_path": "/rds-unencrypted.tf", "resource": "aws_db_instance.db", "severity": "HIGH" },
+      { "check_id": "CKV_AWS_62", "file_path": "/iam-wildcard.tf", "resource": "aws_iam_policy.admin", "severity": "HIGH" },
+      { "check_id": "CKV_AWS_3", "file_path": "/ebs-unencrypted.tf", "resource": "aws_ebs_volume.v", "severity": "HIGH" },
+      { "check_id": "CKV_AWS_18", "file_path": "/s3-secure-control.tf", "resource": "aws_s3_bucket.secure", "severity": "LOW" }
+    ]
+  }
+}