fix(network-ops): provision the full toolchain and harden the install script (ENG-8822)

[thomasqbrady]

Summary

On the local Docker sandbox, the network-ops capability (2.1.7) failed to load. Two root causes:

1. Toolchain not installed. Most tools the pipeline shells out to were never declared for install, and several had no pre-flight check — so they were missing at call time with no warning.
2. Install script hard-failed. scripts/install_coercion_tools.sh created root-owned system directories (/usr/share/wordlists, /opt) as the non-root sandbox user under set -euo pipefail, so the first mkdir Permission-denied aborted the whole script and the capability failed to load.

Changes

• Declare the toolchain in capability.yaml:
  • apt: nmap, smbclient, hashcat, john
  • pip: impacket, certipy-ad, bloodyAD
  • NetExec (nxc) is not on PyPI, so the install script fetches its prebuilt standalone binary (pinned v1.5.0, the most recent release carrying a Linux build) and symlinks netexec/NetExec → nxc (the tools invoke netexec).
• Add a checks: entry for every invoked tool and fetched asset, so a gap surfaces in pre-flight rather than as a command-not-found mid-run.
• Harden the install script: every privileged write goes through a sudo -n, non-fatal helper (ensure_writable_dir); downloads and clones are non-fatal. A sandbox without egress or sudo still loads the capability, just without the optional assets.
• Tests (tests/test_provisioning.py): static guards (toolchain declared, every tool checked, no unguarded privileged mkdir, clones conditional) plus a behavioral test that runs the script with every privileged operation failing and asserts it still exits 0.

Verification

• dreadnode capability validate passes (checks report the tools absent on the validation host, as expected — they install at provision time).
• Package resolution and check-alias correctness confirmed by installing each tool on the ubuntu:24.04 runtime base.
• NetExec's prebuilt binary confirmed to run on the real base (ubuntu:24.04 / glibc 2.39) via an E2B sandbox, including invocation through the netexec symlink.
• Full network-ops test suite passes (54 tests).

Note

This PR also lands the capability's in-progress 2.1.7 work (pipeline agents, skills, worker, tool updates) that was already staged in the working tree; the provisioning changes above are the focus.

ENG-8822