feat: add autonomous red team agent, unify blue/red core, and restructure project for dual-mode operations

[l50]

Key Changes:

• Added a fully autonomous Red Team agent with pentesting tools, golden ticket, BloodHound, and ADCS exploitation
• Unified blue and red team agent architecture under a single ares package with shared core, integrations, and templates
• Enhanced blue team agent with precursor investigation logic and improved MITRE/detection recipe chaining
• Major project restructuring: moved all code to src/ares, modularized tools, agents, reports, and templates

Added:

• Autonomous Red Team agent (RedTeamOrchestrator) supporting Active Directory enumeration, credential harvesting, share pilfering, password cracking, BloodHound, ADCS (Certipy), delegation attacks, and golden ticket workflows - src/ares/agents/red/, src/ares/tools/red/, src/ares/reports/redteam.py
• Unified core agent creation and state models for both blue and red team workflows - src/ares/core/
• Comprehensive attack chain and detection recipe YAMLs for MITRE-based precursor and detection question generation - templates/engines/attack_chains.yaml, templates/engines/detection_recipes.yaml
• Extensive Jinja2 prompt templates for red team agents, cracker, share pilfer, golden ticket, and reporting - templates/redteam/agents/, templates/redteam/reports/
• Red team tasks in Taskfile.yaml for orchestrating pentests, EC2 discovery, and SSM log monitoring
• Documentation covering dual blue/red workflows, attack chain logic, and red team usage (README.md, docs/)

Changed:

• Refactored blue team agent and tool APIs to use new ares core, models, and templates (e.g., src/agent.py → src/ares/agents/blue/soc_investigator.py)
• Enhanced investigation prompt logic to always extract MITRE techniques and generate precursor questions
• Improved LogQL query validation, progressive log search, and time handling in blue team tools
• Unified toolset registration and state management for both agent types
• Updated build, packaging, and script entry points to use ares namespace throughout (pyproject.toml, Taskfile.yaml)
• Updated documentation, task usage, and templates to reflect red/blue duality and new command/task structure
• Blue team agent now prioritizes precursor investigation and detection recipes based on attack chain definitions

Removed:

• Deprecated src/ root module files and legacy single-agent structure
• Obsolete blue team-only tool wrappers and duplicated logic (migrated to new modular toolsets)
• Legacy main.py, agent.py, and old-style tools/ modules (replaced with src/ares/main.py and modular imports)
• Unused or redundant code paths now handled by the shared core and templates

[linear]

CAP-787 Migrate Armada Kali Red Team Agent to Ares Codebase

Description:
Migrate the Armada Kali Red Team agent suite—including all specialized agents, data models, and pentesting tools—into the Ares codebase. This will unify red team offensive capabilities with Ares' defensive SOC infrastructure, ensuring alignment with Dreadnode platform standards and enabling integrated purple teaming.

---

Objective:

Fully integrate Armada’s Kali Red Team agents and tools into the Ares codebase using the Dreadnode Agent SDK, providing robust offensive security testing functionality while maintaining separation and safety controls within the SOC platform.

---

Scope of Work:

• Confirm architectural approach (Option A: Full SDK migration)
• Create new directory structure for red team agents, tools, and models in Ares
• Port and adapt Armada data models (op_types.py) to src/models/redteam.py
• Refactor EnumAgent as a Dreadnode agent (proof of concept)
• Migrate CrackerAgent, SharePilferAgent, and GoldenTicketAgent to Dreadnode SDK
• Port all pentesting tool functions to src/tools/redteam/kali_tools.py using Dreadnode’s @tool system
• Implement CLI and Taskfile commands for red team agent execution
• Add Docker deployment configs and ensure isolation of red team operations
• Develop documentation and safety checks for red team functionality
• Write unit and integration tests for all new agents and tools

---

Dependencies:

• Dreadnode Agent SDK and platform integration
• Existing Ares codebase and SOC agent
• Armada Kali source files from /Users/l/dreadnode/armada/armada/examples/kali/
• Docker (and optionally Ansible/AWS SSM for future deployment)
• Addition of rigging>=1.0.0 to dependencies
• Team decision on architecture (Option A confirmation)

---

Acceptance Criteria:

1. Red team agents (EnumAgent, CrackerAgent, SharePilferAgent, GoldenTicketAgent) function as Dreadnode agents within Ares
2. Pentesting tools and data models are fully ported and integrated with observability in Dreadnode platform
3. CLI and Taskfile commands enable safe, authorized execution of red team operations
4. Docker deployment for red team agents and tools is operational and isolated
5. Safety mechanisms (authorization, target validation, logging) are enforced and tested
6. Comprehensive documentation (docs/redteam.md) is available and integrated into main README
7. Unit and integration tests for red team features pass successfully

---

Additional Notes:

• Reference Armada Kali agent architecture doc: /Users/l/dreadnode/armada/armada/examples/kali/AGENT_ARCHITECTURE.md
• Ensure red team and SOC agent logic remain logically and operationally separated
• Initial deployment should focus on Docker for isolation; AWS SSM support can be added in later iterations
• Highlight explicit warnings and authorization requirements in CLI and documentation to prevent misuse
• For purple team reporting, ensure attack actions are visible and traceable in Dreadnode platform

---