feat: add deterministic ADCS ESC4 and ESC8 exploitation chains and agent wrap-up nudge

[l50]

Key Changes:

• Implement deterministic exploitation chains for ADCS ESC4 and ESC8, bypassing unreliable LLM routing
• Add pure helpers for argument construction and parsing in ADCS automation with comprehensive unit tests
• Introduce a wrap-up nudge in the agent loop to prompt early task completion as MaxSteps approaches
• Enhance JSON output with token coverage summaries and ensure consistent category classification

Added:

• Deterministic ADCS ESC4 and ESC8 chains, including helper functions for argument construction, parsing relay output, and candidate capping in adcs_exploitation.rs
• Unit tests for new helpers: administrator_upn, admin_rid500_sid, chain argument builders, relay output parsing, candidate capping, and result detection
• Pure functions for building tool argument JSON for composite tools (build_esc4_chain_args, build_esc1_chain_args, build_relay_coerce_args)
• Token coverage summary output and associated helper function with tests in format/json.rs
• Agent wrap-up nudge logic and associated threshold constant in runner.rs, along with tests for the injection predicate

Changed:

• Switch ADCS ESC4 and ESC8 exploitation from LLM-routed to deterministic, tool-driven chains in adcs_exploitation.rs, ensuring deduplication and correct scoreboard marking
• Use pure helper functions for constructing arguments and parsing tool outputs in ADCS exploitation workflow, reducing code duplication and improving testability
• Expand and restructure MSSQL exploitation objectives to emphasize early exit upon first successful primitive, improving automation efficiency and clarity in mssql_exploitation.rs
• Make token_category function visible to sibling modules for consistent text/JSON classification in display.rs
• Inject a single user-role wrap-up reminder in the agent loop when nearing MaxSteps, to encourage structured task completion and reduce stalls in runner.rs

Removed:

• LLM-based routing for ADCS ESC4 and ESC8 exploitation, replaced by deterministic, directly-invoked composite tools in adcs_exploitation.rs

[codecov]

Codecov Report

❌ Patch coverage is 88.45209% with 47 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.94%. Comparing base (fd28bf4) to head (b126a41).

Files with missing lines	Patch %	Lines
...i/src/orchestrator/automation/adcs_exploitation.rs	88.45%	47 Missing ⚠️

Additional details and impacted files

@@                   Coverage Diff                    @@
##           feat/more-attack-cov     #306      +/-   ##
========================================================
+ Coverage                 75.90%   75.94%   +0.04%     
========================================================
  Files                       439      439              
  Lines                    117164   117571     +407     
========================================================
+ Hits                      88930    89289     +359     
- Misses                    28234    28282      +48     

Files with missing lines	Coverage Δ
...i/src/orchestrator/automation/adcs_exploitation.rs	63.50% <88.45%> (+6.75%)	⬆️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.