fix(install): shared-package conflict + speakeasy/angr helpers

- Shared packages: split the install into two passes
  1. flare-capa + mitmproxy + mitmproxy2swagger + z3-solver
  2. kaitaistruct>=0.11 with --no-deps

  The previous single command failed because mitmproxy 11.0.2
  pins kaitaistruct<=0.10 in its metadata. The two libraries
  are runtime-independent (mitmproxy bundles its own Kaitai
  runtime; we use the 0.11 API directly via re-kaitai) so the
  conflict is purely a metadata issue. --no-deps bypasses
  pip's resolver.

- Speakeasy + angr helpers: copy the vendored
  servers/re-speakeasy/bin/speakeasy-cli and
  servers/re-angr/bin/angr-cli into place + chmod +x. The
  install.log previously showed both as 'not built' because
  install.sh didn't drop the helper scripts.

- Stale message: /mcp '10 servers' -> '15 servers' (we now
  ship re-dotnet, re-leak-scan, re-vtil, re-speakeasy, re-angr
  in addition to the original 10).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

install.sh

@@ -398,10 +398,30 @@ banner "Installing shared Python packages"
 # import (the Kaitai Struct compiler at 0.11 generates 0.11-API code;
 # 0.10 cannot import it). pin the floor so a fresh install doesn't
 # regress to the incompatible 0.10 default.
-"${PIP_CMD[@]}" install 'flare-capa' 'mitmproxy' 'mitmproxy2swagger' 'kaitaistruct>=0.11' 'z3-solver' >>"${LOG_FILE}" 2>&1 \
-    && ok "shared packages installed" \
+#
+# Note on --no-deps for kaitaistruct: mitmproxy 11.0.2 pins
+# kaitaistruct<=0.10 in its metadata, which conflicts with our
+# 0.11 floor. The two libraries are runtime-independent (mitmproxy
+# bundles its own Kaitai runtime; we use the 0.11 API directly via
+# re-kaitai) so the conflict is purely a metadata issue. We install
+# 0.11 with --no-deps to bypass pip's resolver. If a future mitmproxy
+# release lifts the cap, drop --no-deps.
+"${PIP_CMD[@]}" install \
+    'flare-capa' \
+    'mitmproxy' \
+    'mitmproxy2swagger' \
+    'z3-solver' \
+    >>"${LOG_FILE}" 2>&1 \
+    && ok "shared packages installed (flare-capa, mitmproxy, mitmproxy2swagger, z3-solver)" \
     || warn "Some shared packages failed to install (see ${LOG_FILE})"
 
+# kaitaistruct pinned at >=0.11 (KSY file compatibility). Installed
+# separately with --no-deps to bypass the mitmproxy<0.10 pin (see
+# the comment above).
+"${PIP_CMD[@]}" install --no-deps 'kaitaistruct>=0.11' >>"${LOG_FILE}" 2>&1 \
+    && ok "kaitaistruct >= 0.11 installed (--no-deps bypasses mitmproxy's 0.10 pin)" \
+    || warn "kaitaistruct 0.11 install failed; re-kaitai will be unable to import compiled KSY modules"
+
 # ── post-install: extras that the MCP servers need but the .re-* loop doesn't pull
 banner "Installing MCP server extras"
 
@@ -464,6 +484,17 @@ banner "Installing Speakeasy (Mandiant Windows emulator, optional)"
     && ok "speakeasy-emulator installed" \
     || warn "speakeasy-emulator install failed (re-speakeasy will be in degraded mode)"
 
+# speakeasy-cli helper: a thin Python wrapper around
+# speakeasy-emulator that exposes the JSON CLI the re-speakeasy
+# Python MCP server shells out to. The script is vendored with
+# the server source (bin/speakeasy-cli) and is chmod +x'd here.
+if [[ -f "${SERVERS_DIR}/re-speakeasy/bin/speakeasy-cli" ]]; then
+    chmod +x "${SERVERS_DIR}/re-speakeasy/bin/speakeasy-cli"
+    ok "speakeasy-cli helper ready at ${SERVERS_DIR}/re-speakeasy/bin/speakeasy-cli"
+else
+    warn "speakeasy-cli helper script missing at expected path"
+fi
+
 # Tier 3 — angr (Python binary-analysis platform). Optional;
 # angr is a heavy install (~500 MB of deps). Same degraded-mode
 # contract as Speakeasy.
@@ -472,6 +503,16 @@ banner "Installing angr (UC Santa Barbara, optional; heavy)"
     && ok "angr installed" \
     || warn "angr install failed (re-angr will be in degraded mode)"
 
+# angr-cli helper: same pattern as speakeasy-cli. The Python
+# script is vendored with the server source (bin/angr-cli) and
+# is chmod +x'd here.
+if [[ -f "${SERVERS_DIR}/re-angr/bin/angr-cli" ]]; then
+    chmod +x "${SERVERS_DIR}/re-angr/bin/angr-cli"
+    ok "angr-cli helper ready at ${SERVERS_DIR}/re-angr/bin/angr-cli"
+else
+    warn "angr-cli helper script missing at expected path"
+fi
+
 # Tier 3 — VTIL-Core (C++). Heavy build. Optional; if cmake/g++
 # isn't present or VTIL-Core isn't vendored, the re-vtil server
 # stays in degraded mode (every tool returns WARN with a build hint).
@@ -581,4 +622,4 @@ if [[ -f "${VENV_DIR}/bin/activate" ]]; then
     info "To activate the venv:  source ${VENV_DIR}/bin/activate"
 fi
 info "Then run Claude Code:  claude --plugin-dir ${PLUGIN_ROOT}"
-info "Inside Claude Code:    /mcp   to confirm the 10 servers are loaded"
+info "Inside Claude Code:    /mcp   to confirm the 15 servers are loaded"