fix(web-security): add continuous STATUS emission and Unexplored fiel…

[GangGreenTemperTatum]

…d to prevent exploitation drift

Three targeted changes to the web-security agent prompt:

1. Act step now mandates emitting a STATUS line immediately after every action, not only at named milestones (recon, surface completion, conclusion). Continuous emission makes state drift visible before the next action is chosen, preventing silent re-entry into surface scanning.
2. STATUS format gains a mandatory Unexplored field listing attack surfaces observed but not yet deeply tested. A non-empty Unexplored field is an explicit signal that the agent has not reached genuine exhaustion and must return to Decide before concluding.
3. Attack Methodology clarifies that the vulnerability checklist is the minimum bar, not the ceiling. Once standard classes are covered the primary question becomes gadget composition — the most impactful findings are novel chains, not textbook one-shot vulnerabilities.