feat: CLI/REPL/web parity — /compliance, /budget, vuln-class focus from the web

REPL (parity with the one-shot run flags)
- /compliance <pci-dss,hipaa,soc2,gdpr> — map confirmed findings onto frameworks.
- /budget <eco|balanced|aggressive|unlimited> and /budget token <N> — reasoning
  budget + token ceiling. Both applied to the run config at /run (black-box and
  whitebox/greybox), mirroring --compliance / --budget / --token-limit.
- Added to help and Tab completion.

Web console
- The run/whitebox/greybox path (interactive REPL) now also emits the settings it
  was silently dropping: compliance, budget mode, token limit, and vuln-class
  focus — via the REPL's own /compliance, /budget and /class commands (capability,
  in-scope, intercept, sandbox, OOB, scope file stay launch-level in authArgs).
- New "Focus vuln classes" field in the Scope step.

Docs
- TUTORIAL.md: /compliance and /budget in the REPL command reference.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

web/server.js

@@ -1120,6 +1120,16 @@ function buildReplScript(body) {
   if (body.outOfScope) lines.push(`/scope-out ${body.outOfScope}`);
   if (body.creds) lines.push(`/creds ${body.creds}`);
   if (body.research) lines.push(`/research on`);
+  // Settings the wizard collects that are NOT already applied as launch flags
+  // (authArgs) or the scope file. Emitted via the REPL's own commands so a web
+  // run enforces exactly what a typed session would. Capability, in-scope,
+  // intercept, sandbox, OOB, environment, policy and the scope allowlist are
+  // handled at launch in authArgs()/materializeScope() — do not re-emit them here.
+  if (body.classes) lines.push(`/class ${Array.isArray(body.classes) ? body.classes.join(',') : body.classes}`);
+  if (body.revalidatePoc) lines.push('/revalidate on');
+  if (body.budget && body.budget !== 'unlimited') lines.push(`/budget ${body.budget}`);
+  if (body.tokenLimit) lines.push(`/budget token ${body.tokenLimit}`);
+  for (const fw of body.compliance || []) lines.push(`/compliance ${fw}`);
   lines.push((body.agents || []).length ? `/only ${body.agents.join(',')}` : '/only clear');
   // Economy preset last, so it wins over the per-knob settings above.
   if (body.quick) lines.push('/quick');