Render Markdown in AI panels + ordered game-plan summaries

[kocaemre]

Summary

Two UX follow-ups from a fresh beta test of v2.5.0-beta.17, both requested after seeing the AI panels in action.

1. Render Markdown in AI panels

The co-pilot replies in Markdown, but the Explain and Summary panels printed it raw — operators saw literal **bold**, ### headings, and - bullets instead of formatting. Adds a tiny, dependency-free renderer (Markdown.tsx) for the subset the model actually uses: headings, **bold**, *italic*, `code`, and bullet / numbered lists.

• XSS-safe by construction: model output can echo attacker-controlled scan text, so it renders to React text nodes only — no dangerouslySetInnerHTML, and links are deliberately not turned into anchors (no clickable surface from model output).
• Wired into ExplainButton and SummarizeEngagementButton.
• The pure block parser is split into markdown-parse.ts with unit tests (the .tsx isn't importable under the current vitest config).

2. Ordered "game plan" summaries

Both the single-host and cross-host summary prompts now ask for a numbered, sequential game plan — the order of moves to work the target ("do this first, then this, then pivot"), each step naming the target service in bold, the concrete action, and a short why, ending with a one-line best-first-move call-out. With the new Markdown renderer these display as a real ordered list.

Testing

• npm test → 612 passing (adds markdown-parse unit tests).
• npm run typecheck, npm run lint:kb, npm run build — all clean.
• Verified live against real CTF data (HTB Lame/Blocky/Busqueda multi-host engagement): Explain renders bullets/bold, single-host and cross-host summaries render as numbered game plans, and no literal ** / ### remain in the panels.

🤖 Generated with Claude Code