feat: add live security workbench and managed Kali deployment

[spetro511]

What does this PR do?

The Web UI currently exposes most execution progress only through chat. This adds a session-scoped live workbench so operators can follow redacted Activity, Mission posture, topology, Nmap history, target notes, execution readiness, and structured memory while an agent runs.

It also adds an approval-gated Nmap system of record, a pinned MCP catalog with explicit install states, a read-only observer role, and a reproducible localhost-only Kali deployment. Hidden panels receive coalesced event-driven refreshes, stream reconnects recover durable history with a stable cursor, and raw Nmap execution is routed through nmap_scan so approval and topology evidence cannot be bypassed accidentally.

Closes #135

Type of change

• Bug fix
• New feature / agent
• Security tool / MCP server / Bolt plugin
• Agent skill / knowledge base
• UI / TUI improvement
• Documentation
• Refactor / performance
• CI / infrastructure

Security impact

• This PR adds or modifies tool execution (shell, file, network)
• This PR changes agent permissions or scope
• This PR modifies authentication / authorization logic
• This PR has no security impact

How did you verify it works?

• bun turbo typecheck
• 155 changed-area tests plus targeted stable-cursor, stream-disposal, multi-host topology, and Nmap-routing coverage
• Production Web UI and Linux x64 builds
• Live Abliteration.ai task on Kali produced 43 durable events, advanced Mission, projected Topology nodes, and created session Memory

No active target scan was run for this verification.

Checklist

• bun turbo typecheck passes
• Tested locally with at least one LLM provider
• PR is focused on a single change
• No secrets, credentials, or API keys in the diff
• Breaking changes are documented (if any)

[github-actions]

Hey! Your PR title Add the analyst workbench, Nmap topology, and managed Kali deployment doesn't follow conventional commit format.

Please update it to start with one of:

• feat: or feat(scope): new feature
• fix: or fix(scope): bug fix
• docs: or docs(scope): documentation changes
• chore: or chore(scope): maintenance tasks
• refactor: or refactor(scope): code refactoring
• test: or test(scope): adding or updating tests

Where scope is the package name (e.g., app, desktop, cyberstrike).

See CONTRIBUTING.md for details.

[badchars]

Thanks for this comprehensive contribution @spetro511! The live workbench concept with activity/topology/memory panels, approval-gated Nmap routing, and the observer role are all well thought out.

However, we're in the middle of a significant v2.0 architecture rework that touches many of the same areas — session UI, event streaming, tool registry, and deployment infrastructure. Merging this as-is would create substantial conflicts with the direction we're heading.

We already have a Bolt-based deployment infrastructure that we're evolving for container workflows, so the Kali deployment piece may fit better there.

We'll keep this as a reference as we build out v2.0 — several of these ideas align with our roadmap. Closing for now, but your continued contributions would be greatly appreciated as v2.0 shapes up!

[spetro511]

@badchars i have also since developed and flushed out a much cleaner UI than my previous iterations, as well as automated zero touch + minimal distance iOS vectors (TIFF overflow, MDM profile enrollment, etc). I would kill to get a peek at the v2 arch so I don't build on an antiquated base. The platform you and your team have built is truly in a league of its own.