fix: pin web security fallback tools (ENG-8602)

[briangreunke]

Summary

• install ProjectDiscovery fallback tools at explicit versions instead of resolving through PDTM
• pin Go 1.26.6, katana 1.7.0, and kiterunner v1.0.2
• require Node 24 and skip browser downloads in sealed capability installs
• preserve current-main offline, privilege, resolver, and optional-failure behavior

Validation

• ============================= test session starts ==============================
  platform linux -- Python 3.13.3, pytest-9.1.1, pluggy-1.6.0
  rootdir: /tmp/opencode/capabilities-eng-8602
  collected 26 items

capabilities/web-security/tests/test_install_tools_offline.py .......... [ 38%]
................ [100%]

============================== 26 passed in 0.04s ============================== (26 passed)

✓ ai-red-teaming@1.16.3 (agents=3, tools=37, skills=10, mcp=0, workers=0,
hooks=1, policies=0)
✓ analysis-ledger@0.2.1 (agents=1, tools=2, skills=1, mcp=0, workers=0,
hooks=0, policies=0)
! android-apk-research@0.2.0 (agents=0, tools=0, skills=4, mcp=1, workers=0,
hooks=0, policies=0)
check:jadx status=error: exit code 127
check:apktool status=error: exit code 127
check:aapt-or-aapt2 status=error: exit code 127
check:semgrep status=error: exit code 127
check:apkid status=error: exit code 127
✓ atlassian@1.0.0 (agents=0, tools=0, skills=1, mcp=1, workers=0, hooks=0,
policies=0)
! attack-surface-management@2.0.1 (agents=8, tools=10, skills=5, mcp=2,
workers=1, hooks=0, policies=0)
check:bbot status=error: exit code 127
check:neo4j-python status=error: Traceback (most recent call last):
File "", line 1, in
import neo4j
ModuleNotFoundError: No module named 'neo4j'
✓ azure-devops@1.0.0 (agents=0, tools=0, skills=1, mcp=1, workers=0, hooks=0,
policies=0)
! binary-analysis@0.5.0 (agents=1, tools=0, skills=1, mcp=2, workers=0,
hooks=0, policies=0)
check:java-17-for-ghidra status=error: exit code 1
check:ghidra-version-compat status=error: exit code 1
✓ bloodhound@1.0.0 (agents=0, tools=0, skills=1, mcp=1, workers=0, hooks=0,
policies=0)
! bloodhound-enterprise@0.1.0 (agents=3, tools=0, skills=8, mcp=0, workers=0,
hooks=0, policies=0)
tool:asset_groups status=error: No module named 'runtime'
Fix: Check that all dependencies are installed in the runtime
environment
tool:attack_paths status=error: No module named 'runtime'
Fix: Check that all dependencies are installed in the runtime
environment
tool:auth status=error: No module named 'runtime'
Fix: Check that all dependencies are installed in the runtime
environment
tool:cypher status=error: No module named 'runtime'
Fix: Check that all dependencies are installed in the runtime
environment
tool:data_ingestion status=error: No module named 'runtime'
Fix: Check that all dependencies are installed in the runtime
environment
tool:entities status=error: No module named 'runtime'
Fix: Check that all dependencies are installed in the runtime
environment
tool:posture status=error: No module named 'runtime'
Fix: Check that all dependencies are installed in the runtime
environment
✓ dotnet-reversing@1.0.1 (agents=1, tools=20, skills=2, mcp=0, workers=0,
hooks=0, policies=0)
✓ ghostwriter-readonly@1.0.0 (agents=0, tools=0, skills=1, mcp=1, workers=0,
hooks=0, policies=0)
✓ github@1.0.0 (agents=0, tools=0, skills=1, mcp=1, workers=0, hooks=0,
policies=0)
✓ gitlab@1.0.0 (agents=0, tools=0, skills=1, mcp=1, workers=0, hooks=0,
policies=0)
✓ ios-forensics@0.1.0 (agents=1, tools=0, skills=5, mcp=1, workers=0, hooks=0,
policies=0)
✓ linear@1.0.0 (agents=0, tools=0, skills=1, mcp=1, workers=0, hooks=0,
policies=0)
✓ llm-wiki@0.1.0 (agents=1, tools=1, skills=1, mcp=0, workers=0, hooks=0,
policies=0)
✓ memory-forensics@0.1.0 (agents=1, tools=0, skills=5, mcp=1, workers=0,
hooks=0, policies=0)
✓ mythic-c2@2.1.0 (agents=3, tools=0, skills=0, mcp=1, workers=1, hooks=0,
policies=0)
✓ mythic-c2-readonly@1.0.0 (agents=0, tools=0, skills=1, mcp=1, workers=0,
hooks=0, policies=0)
! network-ops@2.1.8 (agents=7, tools=120, skills=3, mcp=0, workers=1, hooks=0,
policies=0)
check:petitpotam status=error: exit code 1
check:dfscoerce status=error: exit code 1
check:shadowcoerce status=error: exit code 1
check:rockyou-wordlist status=error: exit code 1
✓ secure-software@1.0.0 (agents=1, tools=16, skills=3, mcp=0, workers=0,
hooks=0, policies=0)
✓ sliver-c2@1.0.0 (agents=0, tools=0, skills=1, mcp=1, workers=0, hooks=0,
policies=0)
✓ source-code-analysis-worker-template@0.1.0 (agents=8, tools=1, skills=0,
mcp=0, workers=1, hooks=0, policies=0)
✓ spectra-assure@0.1.0 (agents=1, tools=0, skills=1, mcp=1, workers=0,
hooks=0, policies=0)
✓ vuln-assessment-methodology@1.0.0 (agents=0, tools=0, skills=1, mcp=0,
workers=0, hooks=0, policies=0)
! web-security@1.15.1 (agents=1, tools=64, skills=84, mcp=12, workers=0,
hooks=4, policies=0)
check:nuclei status=error: exit code 127
check:httpx status=error: exit code 126
check:subfinder status=error: exit code 127
check:naabu status=error: exit code 127
check:dnsx status=error: exit code 127
check:katana status=error: exit code 127
check:tlsx status=error: exit code 127
check:alterx status=error: exit code 127
check:asnmap status=error: exit code 127
check:uncover status=error: exit code 127
check:interactsh-client status=error: exit code 1
check:protoscope status=error: exit code 1
check:caido-cli status=error: curl: (7) Failed to connect to localhost
port 8080 after 0 ms: Connection refused
check:caido-mcp-server status=error: exit code 1
check:caido-mode status=error: exit code 1
check:burp status=error: exit code 1
check:waymore status=error: exit code 127
check:pacu status=error: exit code 127
check:fireprox status=error: exit code 1
check:archivealchemist status=error: exit code 1
check:ast-grep status=error: exit code 127
check:wrangler status=error: exit code 127
check:jxscout status=error: exit code 127

Validated 26: 20 ok, 6 warn, 0 failed (0 failed; environment-only check warnings)

• check yaml...............................................................Passed
  check for merge conflicts................................................Passed
  check for added large files..............................................Passed
  fix end of files.........................................................Passed
  trim trailing whitespace.................................................Passed
  ruff.....................................................................Passed
  ruff-format..............................................................Passed
  Detect hardcoded secrets.................................................Passed

Supersedes #148. Linear: ENG-8602.