feat: 新增 update_finding_report 工具,写入漏洞 report 字段

- 新增 agent 写工具 update_finding_report(finding_id + report[Markdown]),
  整段覆盖该漏洞的详细报告;finding_id 传 report_finding 返回的 id
- 绑定 worker / planner / mainagent 三个 agent,经 BuiltinToolSeeds 自动入
  tools 目录(首插不覆盖,旧库升级重启即出现,可在 UI 管理/勾选)
- db.SetFindingReportByNodeID / ExplorationStore.SetFindingReport:按 finding
  节点 id 更新独立 findings 行的 report
- 详情页概览已渲染 report,写入后即可展示

go build / agent / server 测试通过。

db/exploration.go

@@ -889,3 +889,9 @@ FROM activity WHERE exploration_id=$1 AND kind<>'thinking' AND id IN (`+strings.
 func (s *ExplorationStore) AddStandaloneFinding(taskID, nodeID int64, vulnclass, name, severity, summary, evidence, worker string, assetIDs []int64) (int64, error) {
 	return s.db.AddFinding(taskID, nodeID, vulnclass, name, severity, summary, evidence, worker, assetIDs)
 }
+
+// SetFindingReport sets a finding's Markdown detail report, addressed by its
+// finding node id (the id report_finding returns). Returns rows affected.
+func (s *ExplorationStore) SetFindingReport(nodeID int64, report string) (int64, error) {
+	return s.db.SetFindingReportByNodeID(nodeID, report)
+}

db/findings.go

@@ -277,6 +277,17 @@ func (d *DB) SetFindingStatus(id int64, status string) (int64, error) {
 	return res.RowsAffected()
 }
 
+// SetFindingReportByNodeID sets the Markdown report on the standalone finding row
+// whose node_id matches — report_finding returns that node id, so an agent tool
+// can address the finding it just created. Returns rows affected (0 when no row).
+func (d *DB) SetFindingReportByNodeID(nodeID int64, report string) (int64, error) {
+	res, err := d.Exec(`UPDATE findings SET report=$1 WHERE node_id=$2`, report, nodeID)
+	if err != nil {
+		return 0, err
+	}
+	return res.RowsAffected()
+}
+
 // SetFindingSeverity updates one finding's severity in the standalone table AND
 // keeps the originating exploration node's payload in sync (the per-task view
 // reads severity from the node payload, not this table). Returns rows affected