feat: cloud / mobile / binary-RE offensive loadouts (arsenal + detection benchmarks)

Three new category loadouts, each = arsenal + an offline-scorable benchmark, opt-in and
honestly scoped (roster marks all 🚧; pacu/frida stay catalog_only, unit-tested non-mintable):
- cloud: aws/az/gcloud + scoutsuite/cloudfox/pmapper; cloud:bench IaC-misconfig detection
- mobile: apkleaks/mobsfscan/drozer/objection/class-dump; mobile:bench static ruleset
- binary/RE: ghidra/objdump/checksec/strings/readelf/gdb; binary:bench decompiled-sink detector

Mobile/binary benches are DETECTOR REGRESSION CHECKS (rules+fixtures co-authored — a pass is a
floor, not a detection rate). No new headline numbers; verify-claims 24/24.

tsc clean; 337 tests; lint 0 errors.

src/__tests__/adapter-tools.test.ts

@@ -56,6 +56,8 @@ describe('adapterToCustomTool — mint gate', () => {
     expect(adapterToCustomTool(adapter('metasploit'), deps)).toBeNull(); // catalog_only
     expect(adapterToCustomTool(adapter('hydra'), deps)).toBeNull();      // catalog_only
     expect(adapterToCustomTool(adapter('bloodhound'), deps)).toBeNull(); // import_only
+    expect(adapterToCustomTool(adapter('pacu'), deps)).toBeNull();       // catalog_only (AWS exploitation framework)
+    expect(adapterToCustomTool(adapter('frida'), deps)).toBeNull();      // catalog_only (runtime code injection)
   });
 
   it('mints a command-ready adapter with a working name + category', () => {
@@ -67,6 +69,30 @@ describe('adapterToCustomTool — mint gate', () => {
   });
 });
 
+describe('cloud/mobile category loadouts — presence + risk gating', () => {
+  const deps = makeDeps();
+  const execOf = (id: string) => adapter(id).execution;
+
+  it('cloud: assessment/recon tools are receipt-gated; the exploitation framework is catalog-only', () => {
+    expect(execOf('scoutsuite')).toBe('receipt_required');
+    expect(execOf('cloudfox')).toBe('receipt_required');
+    expect(execOf('pmapper')).toBe('receipt_required');
+    expect(execOf('pacu')).toBe('catalog_only');
+    expect(adapter('scoutsuite').category).toBe('cloud');
+    expect(adapterToCustomTool(adapter('pacu'), deps)).toBeNull(); // never callable
+  });
+
+  it('mobile: static scanner is safe; dynamic/runtime tools are gated', () => {
+    expect(execOf('apkleaks')).toBe('safe_command');
+    expect(execOf('mobsfscan')).toBe('safe_command'); // static source scanner — safe
+    expect(execOf('objection')).toBe('receipt_required');
+    expect(execOf('frida')).toBe('catalog_only');
+    expect(adapter('apkleaks').category).toBe('mobile');
+    expect(adapterToCustomTool(adapter('frida'), deps)).toBeNull();        // never callable
+    expect(adapterToCustomTool(adapter('apkleaks'), deps)).not.toBeNull(); // safe, mintable
+  });
+});
+
 describe('adapterToCustomTool — degrade / scope / execution', () => {
   it('a missing binary DEGRADES (does not throw) and surfaces the installHint', async () => {
     const deps = makeDeps({ isToolAvailable: async () => false });