feat: add live security workbench and managed Kali deployment

[spetro511]

What does this PR do?

The Web UI currently exposes most execution progress only through chat. This adds a session-scoped live workbench so operators can follow redacted Activity, Mission posture, topology, Nmap history, target notes, execution readiness, and structured memory while an agent runs.

It also adds an approval-gated Nmap system of record, a pinned MCP catalog with explicit install states, a read-only observer role, and a reproducible localhost-only Kali deployment. Hidden panels receive coalesced event-driven refreshes, stream reconnects recover durable history with a stable cursor, and raw Nmap execution is routed through nmap_scan so approval and topology evidence cannot be bypassed accidentally.

Closes #135

Type of change

• Bug fix
• New feature / agent
• Security tool / MCP server / Bolt plugin
• Agent skill / knowledge base
• UI / TUI improvement
• Documentation
• Refactor / performance
• CI / infrastructure

Security impact

• This PR adds or modifies tool execution (shell, file, network)
• This PR changes agent permissions or scope
• This PR modifies authentication / authorization logic
• This PR has no security impact

How did you verify it works?

• bun turbo typecheck
• 155 changed-area tests plus targeted stable-cursor, stream-disposal, multi-host topology, and Nmap-routing coverage
• Production Web UI and Linux x64 builds
• Live Abliteration.ai task on Kali produced 43 durable events, advanced Mission, projected Topology nodes, and created session Memory

No active target scan was run for this verification.

Checklist

• bun turbo typecheck passes
• Tested locally with at least one LLM provider
• PR is focused on a single change
• No secrets, credentials, or API keys in the diff
• Breaking changes are documented (if any)

[github-actions]

Hey! Your PR title Add the analyst workbench, Nmap topology, and managed Kali deployment doesn't follow conventional commit format.

Please update it to start with one of:

• feat: or feat(scope): new feature
• fix: or fix(scope): bug fix
• docs: or docs(scope): documentation changes
• chore: or chore(scope): maintenance tasks
• refactor: or refactor(scope): code refactoring
• test: or test(scope): adding or updating tests

Where scope is the package name (e.g., app, desktop, cyberstrike).

See CONTRIBUTING.md for details.