v1.1.0 — 2026-standard workspace (AI/LLM, new vuln classes, recon depth, hardening)

[DevCop95]

Implements the roadmap in #1.

Highlights

• AI/LLM security reference (docs/ai-llm-security.md, OWASP LLM Top 10) — the biggest 2026 gap.
• 14 vulnerability-class deep-dives added to QUICK-REFERENCE.md (ATO/password-reset, access-control/IDOR, mass assignment, race conditions, JWT/OAuth, GraphQL, prototype pollution, cache poisoning, CORS, subdomain takeover, CSV injection, path traversal + encoding bypass, NoSQL/Elasticsearch Painless injection, cloud secrets in JS bundles).
• scripts/duplicate_check.py — pre-submission self-duplicate check.
• auto-scanner/kev-correlate.sh — CISA KEV correlation + webhook.
• Recon depth: crt.sh + certspotter CT sources, enriched httpx, JS/secret/source-map analysis, API-spec discovery, paramspider/arjun, --passive-only.
• CVE watchlist: NVD Source column + Ivanti/Citrix/Fortinet/Jenkins/GitLab.
• report-template: per-metric CVSS justification, attack scenario, privileges + affected-scope, PoC video slot.

Hardening / fixes

• Portable resolve_ip() (no hard dig dependency); unblocks the CDN scope guard.
• scope_filter_file: no longer errors on missing input; logs discards + candidates-pending-scope.txt.
• crt.sh JSON-validate + retry; recon now probes the target host itself.
• HTTP-probe stage detects the wrong (Python) httpx and skips cleanly.
• pentest-express reflected-XSS grep -c double-zero bug fixed.

Validation

• shellcheck -x -S warning clean on all scripts (Windows + WSL/Linux).
• Repo tests (test-shell-scope.sh, check-sensitive-files.sh) pass; both .py compile.
• Phase-by-phase QA run in real Linux (WSL); CDN guard, certspotter fallback and passive-only verified live.

Closes #1