feat(web-security): add ast-grep to runtime for AST-based JS static a…

[GangGreenTemperTatum]

…nalysis

Install ast-grep (tree-sitter based structural code matching) in the web-security runtime as a lightweight alternative to semgrep for JS/TS pattern matching. Update dom-vulnerability-static-analysis and jxscout-custom-analyzers skills with concrete ast-grep usage patterns and a jxscout script analyzer wrapper.

Summary

The web-security capability has a gap in AST-aware JavaScript analysis when jxscout (commercial) isn't available. The dom-vulnerability-static-analysis skill references semgrep, CodeQL, and ESLint as AST tools, but none are installed in the runtime — leaving the agent with only rg (regex) for source/sink enumeration, which is fragile for code constructs.

This PR adds ast-grep to the runtime as a lightweight, tree-sitter-based structural code matching tool for JS/TS/HTML.

Why ast-grep:

• Tiny Rust binary via pip install ast-grep-cli — minimal image bloat
• Pattern syntax uses real code with $VAR wildcards — natural for LLM agents to generate on the fly
• JSON output with file paths, line/column positions, and captured metavariables
• MIT licensed, no external services or licenses required

Changes:

• Runtime: Added ast-grep-cli to Dockerfile.runtime and install_tools.sh
• capability.yaml: Version bump to 1.4.0, added health check, description update, keyword
• dom-vulnerability-static-analysis: Added concrete ast-grep commands for all sink categories (innerHTML, eval, postMessage, location, React, jQuery) with --json guidance. Repositioned semgrep/CodeQL/ESLint as "Additional AST tools (if operator-installed)"
• jxscout-custom-analyzers: Added complete ast-grep script analyzer integration — ast_grep_to_jxscout.sh wrapper script, settings.jsonc config example, multi-pattern guidance. Updated analyzer type selection guidance to default to ast-grep

Analysis stack (layered):

Layer	Tool	In runtime?	Purpose
1	ripgrep	Yes	Text pattern search
2	ast-grep	Yes (after this PR)	Structural/AST code pattern matching
3	jxscout	Conditional (commercial)	Managed analysis with triage, relationships, wordlists
4	semgrep / CodeQL	No (operator-installed)	Taint tracking and data flow analysis

Test plan

• Installed ast-grep-cli locally and verified all documented patterns match correctly against test JS file
• Verified JSON output format includes file, range, text, metaVariables
• Verified ast_grep_to_jxscout.sh wrapper produces correct jxscout match JSON (kind, value, 1-based line/column)
• Verified empty result handling returns []
• Confirmed binary name is ast-grep (not deprecated sg)
• just validate passes (20 ok, 6 warn — same pre-existing warnings, 0 failed)
• pre-commit passes on all changed files
• Docker build with Dockerfile.runtime (CI)