feat: capture field findings into bundled skills (harness resources)

pineapple-control gains the uplink-pins-phy0 constraint, the five-part
pineapd crash stack, and the standalone PineAPE engine recipe; wifi-deauth
gains the field-verified passive-capture finding (clients that refuse the
evil twin still produce crackable 4-ways of the real AP, [B,1,2,3,4]).
Evil WPA playbook hint mentions the passive fallback. Skills are served to
agents via MCP resources.

payload/user/remote_access/pager-webui/www/index.html

@@ -268,7 +268,7 @@
 <script src="js/xterm-addon-fit.min.js"></script>
 <script src="js/terminal.js"></script>
 <script src="js/pager.js"></script>
-<script src="js/views.js?v=20260818-5"></script>
+<script src="js/views.js?v=20260818-6"></script>
 <script src="js/app.js?v=20260818-3"></script>
 </body>
 </html>

payload/user/remote_access/pager-webui/www/js/views.js

@@ -1654,7 +1654,7 @@ views.attacks_wpa = attackLauncher('wpa', {
     hint: (s, w) => {
       if (!w || !w.enabled) return '1. Set the target SSID and passphrase, pick a channel, Deploy. 2. When the target client is near, use Deauth Targeting below. 3. Captured handshakes appear above — Export and run the hashcat command.';
       if (s && s.handshakes > 0) return 'Handshake captured! Export .hc22000 and run hashcat -m 22000.';
-      return 'AP is live on ' + (w.ssid || 'the target') + '. Watch the handshakes list — use Deauth Targeting to nudge the client.';
+      return 'AP is live on ' + (w.ssid || 'the target') + '. Watch the handshakes list — use Deauth Targeting to nudge the client. If a client refuses to join the twin, its reconnect to the real AP is still captured passively.';
     }
   }
 });