feat(arsenal): add six keyless recon/OSINT adapters with arg templates

Adds whatweb, wafw00f, amass, dnsx, testssl.sh, and waybackurls to the
arsenal catalog — all keyless, non-dangerous recon/OSINT tools that fill
live gaps in web fingerprinting, WAF detection, passive attack-surface
mapping, DNS validation, TLS posture, and historical-URL discovery.

Each adapter follows the CONTRIBUTING.md checklist and each gets an explicit
ARG_TEMPLATES entry in adapter-tools.ts, so:

  - amass uses the required `enum -passive -d <target>` form (not a bare
    positional), and dnsx passes the target via `-d` with resolve flags —
    both fixing the broken default-positional invocation flagged in review.
  - all six are accounted-for (templated), so they never land in the
    arsenal-count-honesty guard's UNACCOUNTED set — no KNOWN_DEBT needed.

Scoped to the six adapters and their templates only. typecheck clean,
tests pass.

src/arsenal/adapter-tools.ts

@@ -355,6 +355,41 @@ const ARG_TEMPLATES: Record<string, ArgTemplate> = {
     defaultTimeoutMs: 180_000,
     build: (target, params) => ['--json', scanPath(target, params)],
   },
+
+  // ── Recon / OSINT adapters (networked) ─────────────────────────────────────────────────────────
+  whatweb: {
+    targetParam: 'url',
+    defaultTimeoutMs: 60_000,
+    // JSON straight to stdout; --no-errors keeps a single unreachable host from aborting the run.
+    build: (target) => ['--log-json=-', '--no-errors', target],
+  },
+  wafw00f: {
+    targetParam: 'url',
+    defaultTimeoutMs: 60_000,
+    build: (target) => [target, '-a', '-f', 'json', '-o', '-'],
+  },
+  amass: {
+    targetParam: 'domain',
+    defaultTimeoutMs: 300_000,
+    // `enum` subcommand is required; -passive keeps it to OSINT sources (no active resolution/brute).
+    build: (target) => ['enum', '-passive', '-d', target],
+  },
+  dnsx: {
+    targetParam: 'domain',
+    defaultTimeoutMs: 120_000,
+    // dnsx takes the domain via -d (comma-sep/stdin), never a bare positional.
+    build: (target) => ['-d', target, '-a', '-aaaa', '-cname', '-resp', '-json', '-silent'],
+  },
+  'testssl.sh': {
+    targetParam: 'url',
+    defaultTimeoutMs: 300_000,
+    build: (target) => ['--quiet', '--color', '0', target],
+  },
+  waybackurls: {
+    targetParam: 'domain',
+    defaultTimeoutMs: 60_000,
+    build: (target) => [target],
+  },
 };
 
 /** Fallback for any mintable adapter without a bespoke template: pass the target as a positional arg. */