Bound Nmap XML and sandbox scanner version probes

[crypt0rr]

What changes

The Nmap XML parser preflights the bounded document before materializing selected hosts. It rejects malformed or over-budget results as scan errors, bounds selected-host decoding and positive-port expansion to the invocation scope, and uses a fixed-size bitset plus a cancellation-aware second pass for folded port ranges.

Each real invocation is limited to 65,536 address × scoped-port slots, matching the planner's work-unit budget. Direct and legacy scan paths batch to that same limit and retain cumulative progress. A single host with all 65,535 ports remains supported; a selected two-host 131,070-slot result rejects before materialization. Errors do not silently truncate results or replace a prior baseline. This bounds one parser invocation, not the completed job's merged snapshot.

Nmap and Naabu startup version probes run through the configured scanner policy. The daemon captures bounded versions at startup and the capabilities endpoint serves those cached values. Host commands that construct an App without scanner policy skip both probes and retain unknown, so notify test and baseline review do not start scanner binaries.

The scanning, container-hardening, and API compatibility guides plus SECURITY.md document the limits and behavior.

Closes #1390
Closes #1408
Closes #1411

Validation

• Exact-head hosted run 38434559464 passed all Go shards and full race, the complete coverage profile, frontend/browser, container, and native ARM64 sandbox checks. CodeQL and the documentation deployment/build checks also passed.
• Official merged profile: 88.6% aggregate coverage and 1,118/1,370 changed lines (81.61%), above the 80% gate.
• Local Go 1.27.2 focused regressions, go vet ./..., make security, formatting and diff checks passed. A full local go test -race -cover -timeout=25m ./... also passed before the test-only coverage additions; it did not emit a full local coverprofile.
• Node 24.21.0 frontend install/build and docs build passed. Docs checked 23 pages and 1,552 links/assets; the pre-existing Astro /404 route warning remains. Changed guides were reviewed at desktop and 320px widths.
• Image sha256:3c0642ac3fabcf00f39f38c71f22da38a3a7a66a290653aaaa4cdae3022809dc was built from this source and passed verify-scanner-sandbox.sh: controlled TCP/UDP and Naabu scans, sandbox identities/capabilities/Landlock/seccomp, cancellation, private inputs, and notification delivery passed. The hosted container/vulnerability checks passed too.

[cloudflare-workers-and-pages]

Deploying edgewatch with    Cloudflare Pages

Latest commit:	d07705f
Status:	✅  Deploy successful!
Preview URL:	https://1f67b761.edgewatch-cpd.pages.dev
Branch Preview URL:	https://fix-nmap-bounded-xml-1390-14.edgewatch-cpd.pages.dev

View logs