feat(web-security): geo-distributed DNS resolution via Shodan/Censys open resolvers

[GangGreenTemperTatum]

Summary

Add geo-distributed routing testing to the web-security capability for detecting geo-fenced infrastructure invisible from a single vantage point.

When authorized by the operator (GEO_RESOLVERS_ENABLED) and API keys are available, open recursive resolvers discovered via Shodan or Censys act as regional DNS vantage points. Resolving target hostnames through resolvers in different countries reveals whether authoritative nameservers return region-specific A/AAAA records — the DNS-layer footprint of geo-fencing, GSLB routing, and region-locked infrastructure.

Orthogonal to IP rotation (flareprox/fireprox): those change the egress IP for HTTP requests; this changes the vantage point for DNS lookups.

New files

• tools/geo_resolvers.py (989 lines) — Zero-dependency async DNS engine (raw UDP), Shodan + Censys Platform API v3 discovery, resolver verification, divergence analysis, 5 LLM-facing tools
• tests/test_geo_resolvers.py (800 lines) — 76 tests covering DNS wire format, provider parsing, authorization gate, divergence analysis, all tools
• skills/distributed-routing-testing/SKILL.md (119 lines) — Full workflow playbook

Updated files

• capability.yaml — 1.12.0 → 1.13.0, description updated, 6 keywords added
• agents/web-security.md — Tool usage guidance added

Tool surface (5 tools)

Tool	Purpose
check_geo_resolver_readiness	Gate state + credential inventory
discover_open_resolvers	Find + verify resolvers per country via Shodan/Censys
list_open_resolvers	Show session cache
resolve_via_open_resolvers	Multi-country resolution + divergence diff
clear_open_resolver_cache	Wipe cache between engagements

Design decisions

• Authorization gate: GEO_RESOLVERS_ENABLED follows the IPROTATE_ENABLED precedent — every tool checks it, no network activity when unset
• Two providers, auto-selection: Shodan (SHODAN_API_KEY) and Censys Platform v3 (CENSYS_PAT); auto picks whichever key is present
• Resolver verification: Candidates probed against one.one.one.one → {1.1.1.1, 1.0.0.1}; hijacking resolvers discarded to prevent false divergence
• Session-scoped cache: PrivateAttr(default_factory=dict) — nothing written to disk
• Public-repo safe: API keys redacted from all error paths, private/loopback/reserved IPs rejected, rate-capped (20 countries, 25 hostnames, 5 resolvers/country)

Validation

• 76/76 tests pass (0.48s)
• just validate: web-security@1.13.0 validates (53 tools, 83 skills)
• Pre-commit: all 8 hooks pass
• No ruff lint violations

Closes: CAP-1189