fix(attack-surface-management): provision runtime dependencies

[GangGreenTemperTatum]

Summary

• declare the native nmap package for managed sandbox provisioning
• align manifest Python dependencies with the capability package (fastmcp, aiodocker)
• add readiness checks for bbot, nmap, neo4j, and fastmcp
• bump the capability/package version to 2.0.1

Validation

• pre-commit run --files capabilities/attack-surface-management/capability.yaml capabilities/attack-surface-management/pyproject.toml capabilities/attack-surface-management/tests/test_bbot_mcp.py
• pytest -q tests/test_worker_coordinator.py
• pytest -q tests/test_bbot_mcp.py -k manifest
• just validate (timed out after 120s; targeted checks passed)

Scope

This is intentionally a KISS packaging fix. It provisions declared runtime dependencies and surfaces missing prerequisites early. It does not provision a Neo4j server; managed deployments must still provide Neo4j or use the documented graph_api_url mode.