recon: intense multi-round active recon (deep_recon) with tool auto-install

Recon was a single quick model pass — now it's deep and iterative:
- deep_recon(): an initial deep enumeration pass then follow-up EXPANSION rounds
  that chase discovered subdomains/hosts/endpoints/params, converging when a
  round finds nothing new. Rounds scale with intensity.
- recon_intensity_directive(): tells the agent HOW hard to recon and to INSTALL
  the tools it needs (apt/pip/go/npm/cargo) — subfinder/amass/httpx/gau/katana/
  gf/arjun/ffuf/nuclei/nmap/dnsx/linkfinder/whatweb/nikto/testssl — chained
  (subfinder->httpx->katana/gau->gf->ffuf); covers subdomains, crawl+wayback, JS,
  content/param discovery, ports, versions, API, exposures, TLS/headers.
- RunConfig.recon_intensity (default 3) + REPL /recon <1-4> + CLI --recon <1-4>
  (1 quick .. 4 exhaustive); shown in /show.

RELEASE.md

@@ -41,6 +41,20 @@ and pick your engagement type up front in a new **onboarding wizard**. Library
   Skills/Plugins/n8n** — then the box type (black/white/grey for web) and the
   minimal setup, so a plain `/run` does the right thing. Scope shown in `/show`.
 
+## Intense, multi-round recon
+
+- Recon is no longer a single quick pass. **`deep_recon`** runs an initial deep
+  enumeration then **follow-up expansion rounds** that chase what the previous
+  round found (new subdomains/hosts, unmapped endpoints, promising paths/params),
+  converging when nothing new appears.
+- Agents are told to **install the tools they need** (apt/pip/go/npm/cargo) —
+  subfinder/amass, httpx, gau/waybackurls/katana/hakrawler, gf, arjun/paramspider,
+  ffuf/feroxbuster, nuclei, nmap/rustscan, dnsx, linkfinder, whatweb, nikto,
+  testssl — and chain them (subfinder→httpx→katana/gau→gf→ffuf).
+- **`/recon <1-4>`** (REPL) and **`--recon <1-4>`** (CLI) set the intensity:
+  1 quick · 2 standard · 3 deep (default) · 4 exhaustive — more rounds + wider
+  enumeration at higher levels. Best on Kali; degrades to curl/nc if installs fail.
+
 ## Models
 
 - Added **`anthropic:claude-sonnet-5`** and **`xai:grok-4.5`**.