Add measured ProjectDiscovery reconnaissance to web-security

[GangGreenTemperTatum]

Summary

• add a focused initial-recon skill for domain, wildcard, ASN, IP-list, and CIDR entry points
• prefer the provisioned ProjectDiscovery toolchain for measurable breadth before manual depth
• resolve ProjectDiscovery binaries through a portable scripts/pd-tool entry point, including explicit protection from Python httpx PATH collisions
• verify the full recon toolchain at capability load and make PDTM invocation independent of shell PATH updates
• add a small coverage-ledger writer for scheduled/completed denominators, artifacts, partial runs, and deferred scope
• add regression tests for skill routing, binary resolution, and coverage accounting

Approach

The web-security agent keeps its existing focused OODA loop. Broad scopes now load progressive recon context on demand rather than expanding the base prompt. The skill uses the ProjectDiscovery binaries already provisioned by the capability and hands ranked responsive assets back to normal web-security testing.

The resolver checks $PDTM_BIN_DIR, the standard PDTM install directory, the Go binary directory, and finally PATH. httpx from PATH is accepted only when its version output identifies the ProjectDiscovery implementation.

The coverage ledger records observed completion rather than planned work, so interrupted or deferred phases remain visible without being counted as comprehensive coverage.

Validation

• 303 passed across the full web-security test suite
• 16 passed in the new focused recon tests
• just validate completed with no capability failures; existing optional local checks remain warnings
• pre-commit YAML, Ruff, formatting, and gitleaks hooks passed
• shell syntax and Python compilation checks passed
• all configured ProjectDiscovery binaries resolved successfully through scripts/pd-tool

Follow-up

A future change can add a dedicated large-scope recon agent or worker pipeline with explicit phase budgets and child-run cost accounting. This change intentionally keeps orchestration out of scope and adds only the context and deterministic helpers needed by the existing web-security agent.