feat: cloud / mobile / binary-RE offensive loadouts (arsenal + detection benchmarks)

Three new category loadouts, each = arsenal + an offline-scorable benchmark, opt-in and
honestly scoped (roster marks all 🚧; pacu/frida stay catalog_only, unit-tested non-mintable):
- cloud: aws/az/gcloud + scoutsuite/cloudfox/pmapper; cloud:bench IaC-misconfig detection
- mobile: apkleaks/mobsfscan/drozer/objection/class-dump; mobile:bench static ruleset
- binary/RE: ghidra/objdump/checksec/strings/readelf/gdb; binary:bench decompiled-sink detector

Mobile/binary benches are DETECTOR REGRESSION CHECKS (rules+fixtures co-authored — a pass is a
floor, not a detection rate). No new headline numbers; verify-claims 24/24.

tsc clean; 337 tests; lint 0 errors.

package.json

@@ -28,6 +28,10 @@
     "cve:bench": "node scripts/cve-hunt-bench.mjs",
     "cve:bench:live": "node scripts/cve-hunt-bench.mjs --live",
     "cve:bench:adversarial": "node scripts/cve-hunt-bench.mjs --adversarial",
+    "cloud:bench": "node scripts/cloud-misconfig-bench.mjs",
+    "cloud:bench:live": "node scripts/cloud-misconfig-bench.mjs --live",
+    "mobile:bench": "node scripts/mobile-static-bench.mjs",
+    "binary:bench": "node scripts/binary-vuln-bench.mjs",
     "keys": "bash scripts/keys.sh",
     "keys:list": "bash scripts/keys.sh list",
     "obsidivm": "node scripts/obsidivm-bridge.mjs",