fix: harden NTLM hash validation and improve cross-forest secretsdump

[l50]

Key Changes:

• Enforced strict NTLM hash validation (32 hex chars) at publish and dispatch
• Added immediate cross-forest secretsdump after Kerberos ticket forge
• Improved domain promotion logic for child domains based on forest knowledge
• Expanded tests for malformed hash rejection and domain inference

Added:

• Immediate cross-forest secretsdump dispatch after inter-realm ticket creation
  to quickly exploit misconfigured trusts and avoid unnecessary delays
• Additional tests for NTLM hash length/format validation and for domain
  promotion via forest-root knowledge

Changed:

• NTLM hash handling now strictly requires exactly 32 hexadecimal characters;
  malformed hashes (relay artifacts, truncated, or non-hex) are rejected before
  entering state or being dispatched to LAPS automation
• LAPS hash sweep and hash publication paths enforce stricter NTLM validation,
  with clear warnings and additional test coverage for edge cases
• Domain candidate promotion (hostname inference) now allows multi-label child
  domains (e.g., child.contoso.local) to be auto-promoted if their parent
  domain is already known, while preventing bare TLD promotion
• Taskfile cross-compilation logic now prefers cross on macOS and
  cargo-zigbuild on Linux for improved reliability with platform quirks

Removed:

• Acceptance of malformed NTLM hashes in state, ensuring only valid hashes are
  processed and stored

[codecov]

Codecov Report

❌ Patch coverage is 98.52941% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 78.78%. Comparing base (5282fbe) to head (3754110).

Files with missing lines	Patch %	Lines
...i/src/orchestrator/state/publishing/credentials.rs	97.91%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #320   +/-   ##
=======================================
  Coverage   78.78%   78.78%           
=======================================
  Files         439      439           
  Lines      124638   124664   +26     
=======================================
+ Hits        98190    98215   +25     
- Misses      26448    26449    +1     

Files with missing lines	Coverage Δ
ares-cli/src/orchestrator/automation/laps.rs	92.62% <100.00%> (-0.04%)	⬇️
...src/orchestrator/result_processing/admin_checks.rs	57.11% <100.00%> (-0.28%)	⬇️
...-cli/src/orchestrator/result_processing/parsing.rs	98.76% <100.00%> (-0.02%)	⬇️
...es-cli/src/orchestrator/result_processing/tests.rs	100.00% <100.00%> (ø)
...s-cli/src/orchestrator/state/publishing/domains.rs	99.10% <100.00%> (-0.02%)	⬇️
...i/src/orchestrator/state/publishing/credentials.rs	89.69% <97.91%> (+0.46%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.