[substrate] Add Docker socket abuse catalog entry

[gapilongo]

Problem

Container escape is named in README's "Honest limitations" as a substrate gap. The most common container-escape primitive — finding a mounted Docker socket (/var/run/docker.sock) inside a container — has no catalog entry. Operator question "I'm in a container with the docker socket mounted, how do I escape?" currently falls back to model recall.

Acceptance criteria

• New file data/technique_catalog/docker_socket_abuse.yaml:
  • technique_id: docker_socket_abuse
  • attack_ids: [T1611] (Escape to Host)
  • aliases: ["docker.sock mount", "Docker socket escape", "container escape via docker.sock"]
  • defining_conditions:
    • Container has /var/run/docker.sock (or /run/docker.sock) mounted
    • Process inside container has read+write to the socket
  • exploitation_steps: literal commands — docker -H unix:///var/run/docker.sock run -v /:/mnt -it alpine chroot /mnt /bin/sh and the API variant via curl
  • detection_signals: container audit events, Falcon for Linux container-escape signature names, k8s admission-controller policies
  • hardened_mitigations: don't mount the socket, use Docker Socket Proxy (Tecnativa), Pod Security Policies / Pod Security Standards
• Concept keywords registered in src/agent/retrieval_coverage.py
• Unit test in tests/agent/test_technique_catalog.py

Pointers

• Schema reference: data/technique_catalog/esc1.yaml
• HackTricks: https://book.hacktricks.xyz/linux-hardening/privilege-escalation/docker-security/docker-breakout-privilege-escalation
• MITRE T1611: https://attack.mitre.org/techniques/T1611/

Difficulty

S (1-2 hours) — content curation.