feat: cloud / mobile / binary-RE offensive loadouts (arsenal + detection benchmarks)

Three new category loadouts, each = arsenal + an offline-scorable benchmark, opt-in and
honestly scoped (roster marks all 🚧; pacu/frida stay catalog_only, unit-tested non-mintable):
- cloud: aws/az/gcloud + scoutsuite/cloudfox/pmapper; cloud:bench IaC-misconfig detection
- mobile: apkleaks/mobsfscan/drozer/objection/class-dump; mobile:bench static ruleset
- binary/RE: ghidra/objdump/checksec/strings/readelf/gdb; binary:bench decompiled-sink detector

Mobile/binary benches are DETECTOR REGRESSION CHECKS (rules+fixtures co-authored — a pass is a
floor, not a detection rate). No new headline numbers; verify-claims 24/24.

tsc clean; 337 tests; lint 0 errors.

scripts/cloud-misconfig-bench.d.mts

@@ -0,0 +1,28 @@
+// Types for the cloud-misconfig benchmark's pure exports (consumed by the vitest test).
+// The runnable logic lives in the sibling .mjs (scripts run under bare `node`, no build step).
+export interface CloudFixture {
+  id: string;
+  desc: string;
+  clean: boolean;
+  expect: string[];
+  hcl: string;
+}
+export interface CloudCorpus {
+  target_checks: string[];
+  fixtures: CloudFixture[];
+}
+export interface CloudScore {
+  detection: { hits: number; total: number; rate: number };
+  discrimination: { clean: number; falsePositives: number };
+  perFixture: Array<{
+    id: string;
+    clean: boolean;
+    ok: boolean;
+    expected?: string[];
+    detected?: string[];
+    falsePos?: string[];
+  }>;
+}
+export function loadCorpus(): CloudCorpus;
+export function parseCheckov(json: unknown): Record<string, Set<string>>;
+export function scoreCorpus(corpus: CloudCorpus, byFixture: Record<string, Set<string>>): CloudScore;