docs: operator-install READMEs for 11 capabilities

[monoxgas]

What

Adds READMEs to the 11 capabilities on main that lacked one, written to the operator-install bar: what it is → how to stand it up → what to know before trusting it. Agent-runtime content (attack methodology, tool-by-tool usage, query idioms) stays in skills/ — the README is for the person installing and running the capability, not the agent at runtime.

New: ai-red-teaming, android-apk-research, bloodhound, dotnet-reversing, ios-forensics, memory-forensics, mythic-c2, network-ops, secure-software, sliver-c2, web-security.

Reciprocal sibling cross-links also added to existing READMEs: mythic-c2 ↔ mythic-c2-readonly, secure-software ↔ spectra-assure (both ReversingLabs), bloodhound ↔ bloodhound-enterprise.

Length follows install complexity, not feature count

	lines	driver
sliver-c2 / bloodhound / dotnet-reversing	27–29	thin connector / invisible bootstrap
mythic-c2 / memory-forensics / web-security	32–42	feature flags / symbol-pack setup / 10-server toolchain
secure-software / ai-red-teaming / android / ios-forensics / network-ops	43–59	genuinely install-heavy

web-security (68 skills + 10 MCP servers) is 42 lines — skills grouped into one family line, servers tabled by what needs setup. mythic-c2 is 32 — the three flags gating active post-ex + the background worker are the whole operational story.

Scope

• Excludes binary-analysis (not yet on main — belongs with its promotion PR) and windows-reversing (being superseded).
• Guidance used: the ### README operator-lens bar in reviewing-capabilities (dreadnode/capabilities-internal#109).

Validation

just validate → 17 ok/warn, 0 failed (3 warns pre-existing local-env). pre-commit clean.

🤖 Generated with Claude Code