Recon workspace pipeline: add infrastructure enrichment stage contracts

[mswell]

Parent

• PRD: Deepen the Recon Workspace Pipeline #29

What to build

Add diagnosable stage contracts for infrastructure enrichment stages in the recon workspace pipeline. Representative stages should include dnsrecords, screenshot, faviconEnum, and the IP-to-host/Nuclei path where feasible, while preserving current user-facing function names and artifact names.

This slice should make enrichment stages report missing workspace artifacts consistently and expose dry-run/plan output so a bug bounty hunter can understand what will happen before running heavier tooling.

Acceptance criteria

• Representative infrastructure enrichment stages have recon workspace pipeline contracts with required inputs and expected outputs.
• Missing prerequisites such as clean.subdomains, ALLHTTP, 200HTTP, dnsx.txt, or cleanHakipResult.txt fail early with recovery-oriented diagnostics.
• Dry-run/plan mode reports intended commands and output artifacts without invoking DNS, screenshot, or scanner tools.
• Existing artifact names such as dnsx.txt, dnshistory/*, aqua_out, outputFavFreak, ALLHTTP, and resultNuclei are preserved where applicable.
• Tests use fake workspace files and command adapters instead of real network/scanner execution.
• Tests verify behavior through the recon workspace pipeline seam.

Blocked by

• Recon workspace pipeline: deepen live-host stages with shared validation and artifact categorization #62