feat(config)!: replace vuln_classes with agentic_sast

Wire Agentic SAST and reconciliation into the main pipeline, persist their durable state, and add the Miscellaneous finding and exploitation lane.

Make scan completion, cancellation, partial outcomes, resume identity, and report recovery use the integrated final workflow contract. Introduce the atomic finalization, ordering, renumbering, compaction, and output services that workflow calls. Keep completed Miscellaneous work and report drafts idempotent across resume, preserve public main's default-on exploit SARIF behavior, and describe stage-fallback candidates without claiming they were exported.

BREAKING CHANGE: `vuln_classes` has been removed. Configs containing it now fail validation, and all five core pentest classes run on every scan.

Workspaces created by Shannon 2.x cannot be resumed. Finish or discard in-flight scans before upgrading, then start a new workspace name.

apps/worker/src/services/exploit-renderer.ts

@@ -8,7 +8,7 @@
  * Deterministic exploit collector → markdown renderer.
  *
  * Single entry point renderExploitDeliverable(vulnClass, state, idToType)
- * covers all exploitation agents. The
+ * covers every exploitation agent, including the conditional `miscellaneous` class. The
  * per-class deltas are limited to title and ID prefix; every section, label,
  * and sort rule is class-agnostic. Section headers and bolded field labels
  * mirror the prescribed-Markdown skeleton from the existing exploit-*.txt