v3.5.0: Claude-Code-style interactive harness (REPL) + instruction-steered testing

- New persistent interactive session (app/src/repl.rs), launched when run with no args:
  banner, model selection, API-key config (/key) or subscription (/sub), then a live
  session to set /target, /repo, /auth, and free-text /focus instructions (or just type
  them) that STEER which agents run and how.
- Slash-commands: /model /providers /key /sub /target /repo /auth /focus /mcp /votes
  /agents /show /run /quit  (+ bare text = focus).
- RunConfig gains `instructions` and `auth`:
  * instructions bias both LLM agent-selection and the heuristic (focus keywords →
    injection/access-control/etc. agents get a strong boost)
  * operator directives (focus + auth) injected into recon and exploit prompts so agents
    test as an authenticated user and prioritise the requested vuln classes
- bump 3.4.1 → 3.5.0 (CLI, harness, reports, credits)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

neurosploit-rs/templates/report.typ

@@ -1,4 +1,4 @@
-// NeuroSploit v3.4.1 — Typst report template (blank, structured).
+// NeuroSploit v3.5.0 — Typst report template (blank, structured).
 //
 // The harness generates `report.typ` per run by prepending a `findings` array
 // and a `meta` dict, then including this template's rendering logic. This file
@@ -24,7 +24,7 @@
 
 #set page(margin: 2cm, numbering: "1", footer: context [
   #set text(size: 8pt, fill: gray)
-  NeuroSploit v3.4.1 · #meta.target · confidential
+  NeuroSploit v3.5.0 · #meta.target · confidential
   #h(1fr) #counter(page).display()
 ])
 #set text(font: ("Helvetica Neue", "Helvetica", "Arial"), size: 10pt)