Expand source-aware testing support

[0xallam]

We already ship a strong set of tools and workflows for dynamic testing (DAST-style recon/scanning), but Strix needs better coverage for source-aware / SAST-style testing. Add more SAST tooling + better agent prompts/skills/playbooks so scans are meaningfully stronger when source code is available.

[mason5052]

Hi! I'd like to work on this.

I've been working on sandbox tool skill docs (Issue #278, PR #325) and noticed semgrep and bandit are already installed in the sandbox Dockerfile. These would be a natural fit for expanding source-aware testing coverage.

Proposed scope for Issue #287:

• semgrep.md -- source-aware pattern scanning with community ruleset selection, language-specific rules, SAST-to-DAST correlation (finding code patterns that map to runtime exploits), and integrating semgrep output into pentest reporting
• bandit.md -- Python-specific security linting, severity/confidence filtering, interpreting findings in context (when a bandit finding is a real risk vs. a false positive), and chaining with manual verification

Both skills would cover:

• Ruleset selection for pentest-relevant findings (not just code quality)
• Output parsing for structured results
• How to prioritize findings when source code is available vs. black-box mode
• Integration with the existing recon -> exploit workflow

Would this direction work for Issue #287, or do you have a specific area you'd like to prioritize first?