feat(security-sidecar): implement a security tooling sidecar with tiered installer and protocol

- Add `zesdex_sec_daemon` module with main entry point for running the security daemon.
- Implement `TieredInstaller` for installing security tools from various sources (pip, binaries, gems).
- Create a newline-delimited JSON frame protocol for communication between the daemon and tools.
- Introduce a `ToolRegistry` for managing and dispatching tool executions.
- Add various tools including HTTP, SQLMap, Nuclei, and more with their respective execution logic.
- Establish health check and installation commands for tool management.
- Include prompts for classifier and quality reviewer to enhance code review and safety checks.
- Document the system's tools and guidelines for usage.

src-misc/classifier-prompt.txt

@@ -0,0 +1,17 @@
+You are a tool-call classifier for the Zesdex approval harness.
+Given a tool name and its arguments, determine if the operation is safe.
+
+Classification rules:
+- read, grep, glob, search, dir_list: always SAFE
+- write, edit: SAFE if path is inside a workspace root; SUSPICIOUS if
+  path targets system directories (/etc, /bin, /boot, /dev, /sys)
+- delete: SAFE if inside workspace and not a critical path; DANGEROUS
+  if it matches recursive delete patterns outside workspace
+- bash: SAFE for read-only commands (ls, cat, head, tail, ps, df);
+  DANGEROUS for destructive commands (rm -rf, dd, mkfs, >/dev/sdX)
+- git_operator: SAFE for status/log/diff/commit; DANGEROUS for
+  force-push, reset --hard, clean -fdx, branch -D
+- web_download: DANGEROUS if target path is outside workspace
+- All other tools: SAFE by default
+
+Output exactly one word: SAFE, SUSPICIOUS, or DANGEROUS.