feat(ssh): add ping/nmap/ca-certificates to base image

A lived-in Linux box ships with iputils-ping, ca-certificates, and nmap
available. Their absence is a cheap tell, and they're handy for letting
the attacker move laterally in ways we want to observe. iproute2 (ip a)
was already installed for attribution — noted here for completeness.

tests/test_ssh.py

@@ -210,6 +210,13 @@ def test_dockerfile_installs_attribution_tools():
         assert pkg in df, f"missing {pkg} in Dockerfile"
 
 
+def test_dockerfile_installs_default_recon_tools():
+    df = _dockerfile_text()
+    # Attacker-facing baseline: a lived-in box has these.
+    for pkg in ("iputils-ping", "ca-certificates", "nmap"):
+        assert pkg in df, f"missing {pkg} in Dockerfile"
+
+
 def test_dockerfile_copies_capture_script():
     df = _dockerfile_text()
     # Installed under plausible udev path to hide from casual `ps` inspection.