The security machine carries gitleaks, trivy, nuclei, zap, testssl.sh and nmap installed from pinned, checksummed sources #9507

Later: Installing pinned, checksummed scanner binaries means changing the forge's host image or rootfs, which a sandboxed builder cannot do or verify; it waits for a person to provision the image.

Split from #9470: the install half, deferred.

Done looks like:

• [ ] Each tool in TOOLS comes from a pinned version with a checksum, through an image layer or a rootfs under the forge's data. Each source is noted in docs/features/machines.md.
• [ ] A run in security can run gitleaks version and trivy --version; a run in standard cannot see either.
• [ ] Reach does not change: the tools can only hit the repository's own app, and the forge's secrets stay denied.
• [ ] A test checks the sandbox mounts for each machine.

Risks: no download at run time. A tool that cannot be pinned is left out and named.