ENG-8834 feat(network-ops): standardize auth params; fix netexec kerberos routing (ENG-8831)

[thomasqbrady]

Summary

Unifies the authentication parameter surface across the network-ops tool family so an agent uses one vocabulary as it chains tools, and removes a silent Kerberos mis-routing in netexec.

Closes ENG-8831 and ENG-8834.

What changed

• nt_hash everywhere for the NTLM hash — retires hash (netexec) and hashes (impacket, bloodyad, krbrelayx, coercion). netexec keeps str | list[str] since nxc accepts multiple hashes/files.
• kerberos: bool across the family. netexec's single kerberos: str is split into kerberos: bool + explicit aes_key / ccache, dropping the len(kerberos) == 32/64 heuristic that silently mis-routed a 32/64-char ccache path to --aesKey and a non-standard AES key to the ccache branch (ENG-8831). bloodyad's use_kerberos folds into kerberos.
• Host naming. certipy's target (which is the DC) becomes dc_ip; bloodyad's DC connection becomes dc_ip, with its DNS override renamed dc_ip_override. target/targets now consistently means the attacked host, dc_ip the domain controller.
• certipy also accepts the family's full LMHASH:NTHASH form (previously NT-only).
• Convention documented in capabilities/AGENTS.md; capability bumped 2.2.1 → 2.3.0 (breaking tool-arg surface change).

Tests

• netexec Kerberos-routing regressions: 64-char ccache → --use-kcache (not --aesKey), aes_key → --aesKey, mutual-exclusion guard, nt_hash → -H.
• Per-wrapper forwarding tests across all 11 kerberos-bearing netexec wrappers.
• certipy hash-format test; family-wide auth-param naming guard.
• Full suite: 154 passing.

Notes

Breaking change: callers using the old arg names (hash/hashes, kerberos=<str>, use_kerberos, bloodyad host, certipy target) must update. No skill/agent markdown used literal kwargs, so the prose layer is unaffected. The dreadnode-tiger submodule pointer should be bumped to this once merged.

[mkultraWasHere]

nice