[MiRHaDi]

What does this change?

Python tooling in the Kali image can install an unrelated /usr/local/bin/httpx console script. Because /root/go/bin was appended to PATH, an agent invoking httpx could get Python's HTTP client CLI instead of the installed ProjectDiscovery scanner. Prepend the Go tool directory so the intended scanner wins. Add the required changelog entry.

Validation

• Reproduced against a built tool image using two disposable containers with the same image and different PATH order. With the previous order, command -v httpx returned /usr/local/bin/httpx and httpx -version exited 1. With Go first it returned /root/go/bin/httpx and exited 0.
• Both containers used --network none, a read-only root filesystem, dropped capabilities and bounded resources. Both were removed after the check. No target requests were made.
• ruff check . passes. The full Kali image was not rebuilt for this one-line change.
• Frontend files are unchanged. The existing frontend lint command fails because --ext is incompatible with its flat ESLint config; this PR does not alter that command.

Checklist

• Required changelog updated.
• No proprietary services, telemetry, authentication gates or deployment credentials added.
• Runtime reproduction of the changed executable selection.