feat: cloud / mobile / binary-RE offensive loadouts (arsenal + detection benchmarks)

Three new category loadouts, each = arsenal + an offline-scorable benchmark, opt-in and
honestly scoped (roster marks all 🚧; pacu/frida stay catalog_only, unit-tested non-mintable):
- cloud: aws/az/gcloud + scoutsuite/cloudfox/pmapper; cloud:bench IaC-misconfig detection
- mobile: apkleaks/mobsfscan/drozer/objection/class-dump; mobile:bench static ruleset
- binary/RE: ghidra/objdump/checksec/strings/readelf/gdb; binary:bench decompiled-sink detector

Mobile/binary benches are DETECTOR REGRESSION CHECKS (rules+fixtures co-authored — a pass is a
floor, not a detection rate). No new headline numbers; verify-claims 24/24.

tsc clean; 337 tests; lint 0 errors.

scripts/mobile-static-bench.d.mts

@@ -0,0 +1,28 @@
+// Types for the mobile-static benchmark's pure exports (consumed by the vitest test).
+// Runnable logic lives in the sibling .mjs (scripts run under bare `node`, no build step).
+export interface MobileRule {
+  id: string;
+  kind: 'manifest' | 'code';
+  desc: string;
+  test: (c: string) => boolean;
+}
+export interface MobileFixture {
+  id: string;
+  kind: 'manifest' | 'code';
+  desc: string;
+  clean: boolean;
+  expect: string[];
+  content: string;
+}
+export interface MobileCorpus {
+  fixtures: MobileFixture[];
+}
+export interface MobileScore {
+  detection: { hits: number; total: number; rate: number };
+  discrimination: { clean: number; falsePositives: number };
+  perFixture: Array<{ id: string; clean: boolean; ok: boolean; expected?: string[]; detected: string[] }>;
+}
+export const RULES: MobileRule[];
+export function loadCorpus(): MobileCorpus;
+export function detect(content: string, kind?: 'manifest' | 'code'): Set<string>;
+export function scoreCorpus(corpus: MobileCorpus, detectFn?: (content: string, kind?: 'manifest' | 'code') => Set<string>): MobileScore;