[IXI-2773]

Verbatim upstream tools added

Copied three actual defensive tools from CarterPerez-dev/Cybersecurity-Projects (source credits ©AngelaMos, 2026):

• Linux CIS hardening auditor — third_party/community/linux-cis-hardening-auditor/, 20 exact upstream files including 17 Bash runtime scripts, README/DEMO and AGPL license.
• DLP scanner — third_party/community/dlp-scanner/, 52 exact files including the 48-module Python package, pyproject, sample YAML config and AGPL license.
• DNS lookup CLI — third_party/community/dns-lookup/, 9 exact files including six Python source modules, pyproject, README and AGPL license.

Total 81/81 upstream Git blob SHA matches, verified against the import tree. No source transformations or relabeling as original portfolio code.

Provenance and existing evidence

• Extends third_party/community/imports.json from two to five pinned source-only imports.
• Updates scripts/check_community_imports.py to verify the additional import set.
• Documents commands and limits in the community index, root README, third-party credits.
• Adds a scoped .gitattributes rule to prevent Windows line-ending conversions from changing pinned upstream bytes.
• Preserves the earlier evidence-bound third_party/imports.json, fixtures, receipts and two existing example integrations unchanged.

Focused evidence

• Source copy verified: 81/81 Git blob hashes match upstream exactly.
• Python syntax and byte check: 54/54 copied Python modules parsed cleanly.
• Bash syntax check: 17/17 copied shell scripts passed bash -n.
• New import checker AST parsing passed.
• No runtime claims, live host/database/network scans, dependency installations, or full suite tests.

Safety: upstream source is AGPL-3.0-or-later, not independently audited here; use only on authorized systems/data. DLP output may contain sensitive matches and should not be committed. DLP/DNS dependency installs may be substantial.