Add defense-cyber as a task family #191

Context

The cyber pack today only models the offense side: the agent's
task is to retrieve an admin flag, the verifier checks
result.flag == world.flag. Real cyber-range training needs the
defense side too: detect intrusions, patch vulns, correlate alerts.

Architecturally, defense should be a task family on the same pack,
not a separate pack. The world (services, vulns, accounts, networks)
is identical between offense and defense — it's the role, the task,
and the verifier that change.

What this issue tracks

Add defense as a first-class task family in the cyber pack. The
pack should rename from cyber.webapp.offense.v1 to
cyber.webapp.v1 (drop the offense suffix), and the manifest gets a
new field — task_family: "offense" | "defense" (and eventually
"dual") — that the builder branches on.

A defense build produces:

• A different task instruction ("detect the unauthorized access in
  the request log within N ticks", "patch the SQLi on /search", etc.)
• A different verifier shape (alert generated within window? vuln
  patched? response time?)
• A different entrypoint surface — defenders typically have a
  read-only SIEM-like log query API plus actions like "rotate
  credential" / "close port" / "block IP". The offensive surface
  shouldn't be visible.

Why it matters

Cyber training without defense is half the story. Defense is also
where the dual-mode scenario unlocks — realize one world, run two
episodes in parallel, attacker and defender play against each other,
the defender's actions actually affect the attacker's world. That's
the killer training scenario for cyber agents and it's only possible
with a single-pack design.

Where to start

• src/openrange/packs/cyber_webapp_offense_v1/builder.py — the
  ProceduralBuilder that today only generates offense tasks /
  verifiers. Branch on state.manifest.task_family.
• src/openrange/packs/cyber_webapp_offense_v1/checks.py —
  _VERIFIER_SOURCE is the offense flag-comparison verifier; defense
  needs its own template and an LLM-prompt path for graph-aware
  verifiers (mirror llm_generation.py).
• src/openrange/packs/cyber_webapp_offense_v1/codegen/ — the
  realizer needs to also emit a SIEM-shaped log query endpoint that
  defenders can read but offenders can't.
• src/openrange/core/manifest.py — add the task_family field with
  validation.
• docs/start_here.md — orient on Tasks /
  Verifiers / Entrypoints first.

Suggested phasing

1. Rename pack id; add task_family to manifest; offense path
   unchanged.
2. Implement defense task generation (template instruction + verifier
   that grades against the request log).
3. Add the SIEM-shaped read-only log-query entrypoint.
4. (Future, separate issue) task_family: "dual" — realize once,
   start two episodes.

Acceptance for this issue

• Pack id renamed.
• A manifest with task_family: "defense" builds an admitted
  snapshot whose task is detection-shaped.
• The defense verifier runs against the world's request log + agent
  actions and grades correctly on a scripted scenario.
• Existing offense tests pass unchanged.

Notes

This is a meaty issue — open a design doc PR (or comment on this
issue) with the manifest field shape + verifier shape before writing
code, so reviewers can react to the contract before the implementation.