feat(preflight): add exploit-readiness probe and --validate-auth mode, and refresh suggested models (#476)

* feat(preflight): gate scans on an exploit-workload readiness probe

* feat: add --validate-auth to run authentication validation only

* feat: refuse reusing an auth-validation workspace for a scan

* chore: refresh suggested model IDs (Grok 4.7, OpenAI gpt-6-sol, Claude 5)

* fix(preflight): make the exploit-readiness probe trip the cyber safeguard reliably

* chore(preflight): update the exploit-readiness probe prompt

* feat: add --validate-model to run the preflight model checks only

* feat(cli): name cyber-access and app-login steps in the start loader

* feat(cli): refine start loader — skip app-login step when following, annotate preflight label

* feat(status): show Preflight and Cyber access verification rows for gated providers

* chore(preflight): suggest a fallback model in cyber-access remediation hints

* chore(preflight): drop env-var syntax from cyber-access fallback hints

* fix(preflight): separate finding heading from Target line in readiness probe

* refactor(preflight): rename exploit-readiness probe to cyber access verification

* fix(preflight): re-join finding heading with Target line in readiness probe

Reverts the heading/Target split from 22d84f2, gluing each finding's
heading back onto its Target line in the cyber-access probe's user
content.

* feat(validation): show a Checks summary in the validation log

* fix(cli): say a validation run failed, not that it could not start

* docs(ai-providers): replace broken Pi subscription link with /login steps

* feat(preflight): gate the openai-codex subscription on cyber access

apps/cli/src/commands/setup.ts

@@ -36,17 +36,24 @@ const GATEWAY_DIALECTS: readonly {
 
 /** Suggested models per curated provider, best-first. Free-text entry accepts any model in the provider's catalogue. */
 const MODEL_SUGGESTIONS: Readonly<Record<CuratedProviderId, readonly string[]>> = {
-  anthropic: ['claude-sonnet-4-6', 'claude-opus-4-8', 'claude-opus-4-7', 'claude-haiku-4-5-20251001'],
-  openai: ['gpt-5.6-sol', 'gpt-5.5', 'gpt-5.4'],
-  xai: ['grok-4.5'],
+  anthropic: [
+    'claude-sonnet-5',
+    'claude-opus-5',
+    'claude-sonnet-4-6',
+    'claude-opus-4-8',
+    'claude-opus-4-7',
+    'claude-haiku-4-5-20251001',
+  ],
+  openai: ['gpt-6-sol', 'gpt-5.6-sol', 'gpt-5.5', 'gpt-5.4'],
+  xai: ['grok-4.7'],
   'amazon-bedrock': ['us.anthropic.claude-sonnet-4-6', 'us.anthropic.claude-opus-4-8', 'us.anthropic.claude-opus-4-7'],
 };
 
 /** Placeholder shown in the free-text model ID prompt, per curated provider. */
 const MODEL_ID_PLACEHOLDER: Readonly<Record<CuratedProviderId, string>> = {
   anthropic: 'claude-sonnet-4-6',
-  openai: 'gpt-5.6-sol',
-  xai: 'grok-4.5',
+  openai: 'gpt-6-sol',
+  xai: 'grok-4.7',
   'amazon-bedrock': 'us.anthropic.claude-opus-4-8',
 };