fix: pin web security fallback tools (ENG-8602)

[briangreunke]

Summary

• Install the ProjectDiscovery fallback tools at explicit versions instead of resolving them through PDTM.
• Pin Go 1.26.6, katana 1.7.0, and kiterunner v1.0.2.
• Require Node 24, and skip browser downloads in sealed capability installs.
• Detect ProjectDiscovery httpx on PATH, in ~/.pdtm/go/bin, or in ~/go/bin, and treat Python's httpx CLI as missing.
• Keep current-main offline, privilege, resolver, checksum, Caido, and optional-failure behavior. Keep ADM-447's removal of surf.
• Bump web-security from 2.0.0 to 2.0.1.

Revisions

• Base: main@02b775dcba854e447b5bf65589db446383aba142
• Head: 187259319969fbc8a8affb9bf740045ef22b98c4
• On 2026-09-25 the branch was brought onto current main (ADM-81, ADM-447) with a merge commit. No force-push.

Acceptance evidence (ENG-8602)

• git merge-base --is-ancestor origin/main HEAD: pass
• bash -n capabilities/web-security/scripts/install_tools.sh: pass
• uv run --with pytest pytest capabilities/web-security/tests/test_install_tools_offline.py: 27 passed
  • The new httpx guard tests execute the shell function. test_httpx_guard_accepts_projectdiscovery_httpx_on_path fails against the previous guard.
• just validate: 26 validated, 0 failed. The 6 warnings are local environment checks for binaries that are not installed.
• Changed-file pre-commit hooks for the manifest, installer, and tests: pass

CI

Lint, Detect changed capabilities, Validate YAML, Skill security scan, and skillspector all pass on 1872593.

Scope

• capabilities/web-security/scripts/install_tools.sh
• capabilities/web-security/tests/test_install_tools_offline.py
• capabilities/web-security/capability.yaml

Supersedes #148. Linear: ENG-8602. Tiger promotes the merged commit in ENG-8606.

🤖 Generated with Claude Code

[briangreunke]

Automated agent review. This is not a human approval.

[REVIEW] — Code Review

Verdict: APPROVE

Reviewed Revisions

• Base: main@02b775dcba854e447b5bf65589db446383aba142
• Head: 187259319969fbc8a8affb9bf740045ef22b98c4

Findings

No blocking findings.

The prior review of b9380ae requested one change. The have_pd_tool httpx guard mixed && and || without grouping, so a real ProjectDiscovery httpx outside ~/.pdtm/go/bin was reported missing. 1872593 fixes it. The reviewer ran the guard directly and got the expected result in 5 cases:

• PD httpx in ~/go/bin: detected
• PD httpx in ~/.pdtm/go/bin: detected
• Python httpx only: missing
• Python httpx plus PD in ~/go/bin: detected
• Nothing installed: missing

Non-blocking: Go 1.24.3 → 1.26.6 and katana 1.5.0 → 1.7.0 go beyond the current-main pins. The newer ProjectDiscovery pins need them.

Validation

• git merge-base --is-ancestor origin/main HEAD: pass
• bash -n capabilities/web-security/scripts/install_tools.sh: pass
• Offline installer tests: 27 passed
• CI on 1872593: all 5 checks pass

This approval applies only to 1872593. Any new commit needs a new review.