feat: PoC validator, Kali sandbox, intercept proxy, compliance, +8 validators

Closes the three benchmark gaps and adds the two the user asked for.

poc.rs — re-runs each finding's recorded proof and sorts it into reproduced /
changed / gone / unverifiable. The last two are kept apart deliberately: a PoC
that could not be tested (out of scope now, state-changing, nothing recorded)
is never reported as one that failed. Never re-runs a mutating request to
"confirm" it. Can only lower a finding's standing, never raise it. Wired as a
run pass (--revalidate-poc) and a subcommand (neurosploit poc <run> --apply).

proxy.rs — own recording forward proxy (HTTP in full; HTTPS tunnelled with
honest metadata, no fake CA) that chains upstream to Burp / Caido / ZAP /
mitmproxy. A bare tool routes straight through it; own+tool records here and
forwards for full TLS interception. Flows -> flows.jsonl, distinct hosts become
passive-discovery leads. Harness and agent child commands share one route.

sandbox.rs — Kali docker/podman container: no host network, no mounted socket,
no-new-privileges, workdir mounted, proxy/transport env inherited. A missing
runtime is an explicit error, never a silent fallback to host execution — the
whole point being to keep attack payloads off the operator's host. Subcommands
sandbox up|exec|install|down.

compliance.rs — maps confirmed findings onto PCI-DSS v4.0, HIPAA Security Rule
and SOC 2 controls. Phrased as "bears on control X", never "compliant/non-
compliant"; the disclaimer is rendered on top and absence of a finding is never
presented as compliance. Report section + `neurosploit compliance <run>`.

validation.rs — 8 new deterministic validators (19 -> 27 classes): verbose
errors/stack traces (CWE-209), cleartext/HSTS (319), CRLF response splitting
(113), dangerous HTTP methods (650), GraphQL introspection, exposed backup
files (530), Host header injection (644), cacheable private responses (525).
Each names exactly what it saw and rejects the classic false positives (a
block page echoing a payload, the SPA served under a bogus path, a copyright
year mistaken for a code).

All wired through RunConfig, the CLI (global --intercept/--sandbox; run-level
--revalidate-poc/--compliance) and the web console's Tooling & assurance block.
328 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

web/server.js

@@ -603,6 +603,10 @@ function buildArgs(body) {
   if (body.oobHttp) args.push('--oob-http', body.oobHttp);
   if (body.oobDns) args.push('--oob-dns', body.oobDns);
   if (body.sms) args.push('--sms', body.sms);
+  if (body.intercept && body.intercept !== 'off') args.push('--intercept', body.intercept);
+  if (body.sandbox) args.push('--sandbox', body.sandbox === 'default' ? '' : body.sandbox);
+  if (body.revalidatePoc) args.push('--revalidate-poc');
+  for (const fw of body.compliance || []) args.push('--compliance', fw);
   // Authorization: the signed grant caps the scope, the extra in-scope entries
   // can only narrow within it, and the environment scales every risk score.
   for (const entry of body.inScope || []) args.push('--in-scope', entry);
@@ -672,6 +676,10 @@ function authArgs(body) {
   if (body.oobHttp) args.push('--oob-http', body.oobHttp);
   if (body.oobDns) args.push('--oob-dns', body.oobDns);
   if (body.sms) args.push('--sms', body.sms);
+  if (body.intercept && body.intercept !== 'off') args.push('--intercept', body.intercept);
+  if (body.sandbox) args.push('--sandbox', body.sandbox === 'default' ? '' : body.sandbox);
+  if (body.revalidatePoc) args.push('--revalidate-poc');
+  for (const fw of body.compliance || []) args.push('--compliance', fw);
   if (body.budget && body.budget !== 'unlimited') args.push('--budget', body.budget);
   if (body.tokenLimit) args.push('--token-limit', String(body.tokenLimit));
   if (body.deepTestLimit) args.push('--deep-test-limit', String(body.deepTestLimit));