v4.2.2: validation keeps reproducible findings, /pocs command, version bump

Field feedback: real, reproducible findings (missing HSTS, insecure cookie flags,
internal IP leaked in a header) were being down-rated/dropped by the adversarial
opinion-vote. The user's rule: never discard something real; another person must
be able to reproduce the same finding.

Validation:
- has_http_receipt(): a finding whose proof is a captured HTTP response (status
  line / security headers / Set-Cookie / a header the class is proven by) or a
  file:line citation is REPRODUCIBLE by definition.
- validate(): a finding unanimously rejected by the vote but carrying such a
  receipt is NO LONGER dropped — it is kept as needs-review (capped to what the
  receipt alone proves), because "the response lacks HSTS" is a fact, not a
  story. grounded_receipt() now also recognizes an in-prose HTTP receipt.
- reproducibility: a kept finding at a URL with no explicit repro steps gets a
  minimal pasteable `curl -i` so anyone can reproduce the exact finding.

Also:
- /pocs (aliases /poc /evidence /artifacts): list a run's synthesized/written
  PoC + evidence files with their paths (was: "unknown command /pocs").
- version bumped to 4.2.2 across CLI/clap/web; stale v4.2.1/v4.1.0 labels fixed.

423 tests passing.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/public/index.html

@@ -3,7 +3,7 @@
 <head>
 <meta charset="utf-8" />
 <meta name="viewport" content="width=device-width, initial-scale=1" />
-<title>NeuroSploit v4.2.1 — Console</title>
+<title>NeuroSploit v4.2.2 — Console</title>
 <link rel="icon" href="data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 100 100%22><text y=%22.9em%22 font-size=%2290%22>🧠</text></svg>">
 <link rel="stylesheet" href="/vendor/xterm.css" />
 <link rel="stylesheet" href="/style.css" />
@@ -33,7 +33,7 @@
     <div class="sb-groups" id="sbGroups"><!-- populated by app.js --></div>
 
     <div class="sb-bottom">
-      <span class="sb-version" id="sbVersion">v4.2.1</span>
+      <span class="sb-version" id="sbVersion">v4.2.2</span>
       <div class="sb-bottom-actions">
         <button class="icon-btn" id="btnOpenAuth" title="Auth &amp; API keys">🔑</button>
         <button class="icon-btn" id="btnOpenRepl" title="Open terminal (Ctrl+`)">❭_</button>