feat(recon): agent_hints routing map

[JonathanVD43]

Parent

#360

What to build

Extend the recon phase to produce a structured agent_hints map — a record from agent name to a list of prioritised endpoint URLs or patterns. This routes attack surface findings from recon directly to the most relevant specialist agents, so each vuln agent starts with targeted context rather than re-discovering the surface.

End-to-end path:

• Recon-collector MCP server gains a set_agent_hints tool (schema: Record<AgentName, string[]>)
• ReconData type gains an optional agent_hints field
• recon-renderer.ts gains a new section renderer for agent hints (table: agent → endpoints)
• All vuln agent prompts gain an {{AGENT_HINTS}} substitution variable resolved by the prompt-manager at agent startup; resolves to empty string if no hints present for that agent

This feature is unconditional — it benefits all Shannon scans, not only bounty mode.

Acceptance criteria

• set_agent_hints tool registered in recon-collector MCP with correct schema
• ReconData type updated; recon-renderer.ts renders a hints section when present
• All five existing vuln agent prompts + three new ones (when added) accept {{AGENT_HINTS}}
• Running a scan produces agent_hints in the recon deliverable
• Agents with matching hints receive them in their prompt context

Blocked by

None — can start immediately