Recon increment 2: URL/endpoint harvesting (urls/extract/fingerprint)

[Dxsk]

Summary

Three new env-driven recon scripts in the Exegol bundle, focused on building large URL/endpoint datasets fast (no active testing, no sqlmap).

• recon-urls — aggregates all passive URL sources (allurls + gau + waybackurls + urlfinder + waymore, whichever are present) deduplicated → recon/urls_all.txt.
• recon-extract — endpoints from JS (xnLinkFinder/LinkFinder) + secrets (secretfinder) from js.txt; endpoints merged back into the URL base → endpoints.txt / secrets.txt.
• recon-fingerprint — httpx -td (+ whatweb) on alive hosts → tech.txt.
• Chained into recon-full in dependency order (subs → alive → fingerprint → crawl → urls → loot → extract → sourcemaps).
• load_user_setup installs only what Exegol may lack (waybackurls); ProjectDiscovery + LinkFinder already there.

Test Plan

• make test — guard test extended to 9 scripts; full suite 53/53
• make lint — shellcheck clean (if-forms, no SC2015)
• deploy.sh dry-run: the 3 scripts land executable in the bundle
• Manual Exegol smoke: recon-full in a loaded engagement fills urls_all.txt/endpoints.txt/secrets.txt/tech.txt