fix(worker): remove sh entrypoint from distroless security components

[LuD1161]

Summary

• All 5 ProjectDiscovery images (subfinder, dnsx, naabu, amass, notify) are distroless with no /bin/sh, causing exit code 127 when using entrypoint: 'sh'
• Removed shell entrypoint from all components, using image default entrypoint with CLI args passed via command array
• Rewrote naabu and notify from complex shell scripts to TypeScript arg building with IsolatedContainerVolume for file I/O
• Set HOME=/tmp for all components (images run as nonroot, /root is not writable — was causing permission denied errors)
• Documented the distroless image pattern in component-development.mdx

Changes

File	Change
worker/src/components/security/subfinder.ts	Removed entrypoint: 'sh', empty command, HOME=/tmp
worker/src/components/security/dnsx.ts	Same pattern
worker/src/components/security/amass.ts	Same pattern
worker/src/components/security/naabu.ts	Full rewrite: shell script → TypeScript arg builder + IsolatedContainerVolume
worker/src/components/security/notify.ts	Full rewrite: shell script → TypeScript arg builder + IsolatedContainerVolume
worker/src/components/security/__tests__/naabu.test.ts	Updated assertions for new runner config
docs/development/component-development.mdx	Added distroless image pattern documentation

Test plan

• All 241 unit tests pass
• E2E: Subfinder workflow completed successfully (31 subdomains discovered, no permission errors)
• E2E: Verify naabu scan works end-to-end
• E2E: Verify notify dispatch works end-to-end
• E2E: Verify dnsx resolve works end-to-end
• E2E: Verify amass enum works end-to-end

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.