agents: +8 EOL / end-of-support exploitation agents (library 397)

Detect components past their vendor end-of-life/end-of-support window and exploit
the accumulated, unpatched CVEs (pin exact version → check endoflife.date + CVE
feeds → safe PoC):
- vulns: eol_stack_detection, eol_runtime_exploitation, eol_framework_exploitation,
  eol_cms_exploitation, eol_client_library
- infra: eol_webserver_exploitation, eol_os_service, eol_tls_protocol
Docs: counts 389->397, RELEASE note.

TUTORIAL.md

@@ -40,7 +40,7 @@ You give NeuroSploit a **target** (URL, repo, app, or host/IP). It:
 
 1. **Recons** the target with real tools (curl/nmap/…).
 2. **Intelligently selects** only the agents whose preconditions match the recon
-   (it does *not* blindly run all 389).
+   (it does *not* blindly run all 397).
 3. **Exploits** in parallel — each agent works in a ReAct loop and must prove its
    claim with a **tool receipt** (raw output).
 4. **Validates** every candidate by **cross-model voting** (a different model
@@ -99,7 +99,7 @@ Agents **degrade gracefully**: if `rustscan` is absent they use `nmap`; if neith
 
 ```bash
 neurosploit --version          # neurosploit 3.5.5
-neurosploit agents             # {"vulns":196,...,"chains":12,"total":389}
+neurosploit agents             # {"vulns":196,...,"chains":12,"total":397}
 neurosploit models             # all providers & models
 ```
 
@@ -535,7 +535,7 @@ built from SAST/dataflow), so uncertainty becomes *path reachability*, not state
 
 ## 13. The agent library
 
-`agents_md/` holds **389** markdown agents in categories:
+`agents_md/` holds **397** markdown agents in categories:
 
 | Category | Dir | Count | Purpose |
 |----------|-----|-------|---------|