[FEATURE] Finish attack graph Phase 3c — FixKind mutates, inventory graph, default counterfactuals

[hello-args]

Summary

Complete the remaining Phase 3c attack graph polish: runtime FixKind mutation simulation, inventory multi-server graph layer, and default-on counterfactual/compression export.

Problem

After the initial Phase 3c PR, three plan items were still open:

• FixKind registry mutates blocks were descriptive only (no graph mutation engine)
• Inventory multi-server graph was not started
• Counterfactuals and UI compression required opt-in CLI flags

Expected Behavior

• Applying a FixKind from the registry mutates a graph copy and re-runs template matching to report which fixes eliminate a chain
• Scans with fleet inventory (≥2 servers) attach an inventory graph layer with cross-server toxic-flow edges (W015/W016)
• Counterfactual remediation and path compression are on by default; --no-attack-graph-counterfactuals and --no-attack-graph-compress-ui opt out

Evidence

• src/mcts/scoring/graph_mutate.py — apply_fix_kind, simulate_fixes_for_template
• src/mcts/scoring/graph_inventory.py — attach_inventory_layer
• src/mcts/scoring/graph_counterfactual.py — fix_simulation / effective_fixes on paths
• src/mcts/core/config.py — defaults flipped to True
• tests/scoring/test_graph_phase_3c.py — 14 tests

Impact

Operators get actionable counterfactual fix simulation and fleet-wide graph context without extra flags; closes Phase 3c before Phase 4 runtime validation.

Recommendation

Merge PR #284 to develop after CI green.

Remediation Steps

1. Review graph_mutate registry operations (add_edge, set_reachability, remove_node, remove_nodes)
2. Verify inventory-layer edges on multi-server scans
3. Confirm dashboard/report export includes counterfactual simulation payload

References

• Implementation plan Phase 3c (local/new_plan/referred_implementation_plan.md)
• PR: feat(scoring): Phase 3c attack graph polish #284

Acceptance Criteria

• FixKind mutates applied at runtime with template elimination simulation
• Inventory multi-server graph layer wired from scanner inventory
• Counterfactuals and UI compression default-on with CLI opt-out
• tests/scoring/test_graph_phase_3c.py and full suite (842) pass
• Mini regression R-01–R-25 pass under --strict