feat(arsenal): add six keyless recon/OSINT adapters with arg templates

Adds whatweb, wafw00f, amass, dnsx, testssl.sh, and waybackurls to the
arsenal catalog — all keyless, non-dangerous recon/OSINT tools that fill
live gaps in web fingerprinting, WAF detection, passive attack-surface
mapping, DNS validation, TLS posture, and historical-URL discovery.

Each adapter follows the CONTRIBUTING.md checklist and each gets an explicit
ARG_TEMPLATES entry in adapter-tools.ts, so:

  - amass uses the required `enum -passive -d <target>` form (not a bare
    positional), and dnsx passes the target via `-d` with resolve flags —
    both fixing the broken default-positional invocation flagged in review.
  - all six are accounted-for (templated), so they never land in the
    arsenal-count-honesty guard's UNACCOUNTED set — no KNOWN_DEBT needed.

Scoped to the six adapters and their templates only. typecheck clean,
tests pass.

src/arsenal/catalog.ts

@@ -1126,6 +1126,102 @@ export const TOOL_ADAPTERS: ToolAdapter[] = [
     parserStatus: 'planned',
     notes: 'Local artifact classification and malware-family matching.',
   },
+  {
+    id: 'whatweb',
+    binary: 'whatweb',
+    name: 'WhatWeb',
+    category: 'web',
+    families: ['web_api', 'social_osint', 'reporting_remediation'],
+    risk: 'active',
+    execution: 'receipt_required',
+    networked: true,
+    evidenceKinds: ['technology_fingerprint', 'http_service'],
+    outputFormats: ['json', 'text'],
+    installHint: 'brew install whatweb  # or: gem install whatweb',
+    commandHint: 'whatweb --log-json=- https://example.com',
+    parserStatus: 'text',
+    notes: 'Web stack fingerprinting (CMS, framework, server) to seed targeted follow-up.',
+  },
+  {
+    id: 'wafw00f',
+    binary: 'wafw00f',
+    name: 'wafw00f',
+    category: 'web',
+    families: WEB_FAMILIES,
+    risk: 'passive',
+    execution: 'safe_command',
+    networked: true,
+    evidenceKinds: ['waf_fingerprint'],
+    outputFormats: ['json', 'text'],
+    installHint: 'pipx install wafw00f',
+    commandHint: 'wafw00f https://example.com -f json -o -',
+    parserStatus: 'text',
+    notes: 'Detects and fingerprints the WAF in front of a target so probes can be tuned or throttled.',
+  },
+  {
+    id: 'amass',
+    binary: 'amass',
+    name: 'OWASP Amass',
+    category: 'osint',
+    families: ['web_api', 'cloud_infra', 'social_osint'],
+    risk: 'passive',
+    execution: 'receipt_required',
+    networked: true,
+    evidenceKinds: ['subdomain', 'asn', 'dns_record'],
+    outputFormats: ['jsonl', 'text'],
+    installHint: 'brew install amass',
+    commandHint: 'amass enum -passive -d example.com',
+    parserStatus: 'text',
+    notes: 'Deep passive attack-surface mapping; complements subfinder with ASN and infra correlation.',
+  },
+  {
+    id: 'dnsx',
+    binary: 'dnsx',
+    name: 'dnsx',
+    category: 'dns',
+    families: ['web_api', 'cloud_infra', 'social_osint'],
+    risk: 'passive',
+    execution: 'safe_command',
+    networked: true,
+    evidenceKinds: ['dns_record', 'subdomain'],
+    outputFormats: ['jsonl', 'text'],
+    installHint: 'brew install projectdiscovery/tap/dnsx',
+    commandHint: 'dnsx -d example.com -a -aaaa -cname -resp -json',
+    parserStatus: 'text',
+    notes: 'Fast DNS resolution/validation to confirm live records from discovered candidate hosts.',
+  },
+  {
+    id: 'testssl',
+    binary: 'testssl.sh',
+    name: 'testssl.sh',
+    category: 'crypto',
+    families: ['web_api', 'crypto_secrets', 'reporting_remediation'],
+    risk: 'active',
+    execution: 'safe_command',
+    networked: true,
+    evidenceKinds: ['tls_config', 'cipher_weakness', 'certificate_finding'],
+    outputFormats: ['json', 'text'],
+    installHint: 'brew install testssl',
+    commandHint: 'testssl.sh --jsonfile-pretty - https://example.com:443',
+    parserStatus: 'text',
+    notes: 'TLS/SSL posture check (protocols, ciphers, cert, known CVEs) against an authorized endpoint.',
+  },
+  {
+    id: 'waybackurls',
+    binary: 'waybackurls',
+    name: 'waybackurls',
+    category: 'osint',
+    families: ['web_api', 'social_osint', 'reporting_remediation'],
+    risk: 'passive',
+    execution: 'safe_command',
+    networked: true,
+    evidenceKinds: ['historical_url', 'endpoint'],
+    outputFormats: ['text'],
+    installHint: 'go install github.com/tomnomnom/waybackurls@latest',
+    commandHint: 'waybackurls example.com',
+    parserStatus: 'text',
+    notes: 'Pulls historical URLs from the Wayback Machine to surface forgotten endpoints and parameters.',
+  },
 ];
 
 export const SAFE_COMMANDS = [