feat(web-security): add upstream Caido Go MCP server (caido-go) (CAP-1173)

[GangGreenTemperTatum]

Summary

Wires the full-surface upstream Caido MCP server (c0tton-fluff/caido-mcp-server, 66 tools + 6 resources) into the web-security capability as a new caido-go server, running alongside the existing lightweight Python caido wrapper (unchanged). Both target the same Caido instance via CAIDO_URL.

Changes

• capability.yaml
  • New caido-go stdio MCP server → caido-mcp-server serve; env CAIDO_URL (default http://127.0.0.1:8080), optional CAIDO_ACCESS_TOKEN and CAIDO_ALLOW_SENSITIVE_HEADERS; init_timeout: 60.
  • New caido-mcp-server presence check (command -v or ~/bin fallback), caido keyword.
  • Version bump 1.4.0 → 1.5.0.
• scripts/install_tools.sh — install caido-mcp-server pinned to v4.3.0 from the official GitHub release, SHA-256 verified per-arch (arm64/amd64) before install, idempotent guard, temp cleanup, graceful WARN on failure.
• tests/test_caido_go_mcp.py (new, 15 tests) — lock manifest wiring, presence check, and the install-script pin/verify contract (pinned version, official URL, distinct per-arch checksums, checksum-verified-before-install ordering, idempotency, cleanup).
• tests/test_interrupted_tool_result_hook.py — remove a brittle hardcoded version == "1.3.0" assertion (already failing on main, which is 1.4.0).

Verification

• ✅ Full web-security suite: 318 passed, 0 failed
• ✅ ruff clean (CI critical selectors + full E,F,W on new file)
• ✅ dreadnode capability validate --strict → web-security@1.5.0, mcp=12 (new server counted); only pre-existing macOS-only caido-cli/burp warnings remain
• ✅ Live MCP stdio initialize handshake against Caido returns serverInfo: caido-mcp-server v4.3.0, 66 tools / 6 resources

Notes

• Checksums are pinned to the v4.3.0 Linux release assets. A future version bump must update both install_tools.sh and the PINNED_VERSION constant in the test (the test enforces they stay in lock-step).