feat(14-01): add 5 CI/CD log sources (GitHubActions, TravisCI, CircleCI, Jenkins, GitLabCI)

- GitHubActionsSource: searches GitHub code search for workflow files with provider keywords (token-gated)
- TravisCISource: queries Travis CI v3 API for public build logs (credentialless)
- CircleCISource: queries CircleCI v2 pipeline API for build pipelines (token-gated)
- JenkinsSource: queries open Jenkins /api/json for job build consoles (credentialless)
- GitLabCISource: queries GitLab projects API for CI-enabled projects (token-gated)
- RegisterAll extended to 45 sources (40 Phase 10-13 + 5 Phase 14)
- Integration test updated with fixtures for all 5 new sources
- cmd/recon.go wires CIRCLECI_TOKEN env var

pkg/recon/sources/register_test.go

@@ -16,9 +16,10 @@ func registerTestRegistry() *providers.Registry {
 	})
 }
 
-// TestRegisterAll_WiresAllFortySources asserts that RegisterAll registers
-// every Phase 10 + Phase 11 + Phase 12 + Phase 13 source by its stable name on a fresh engine.
-func TestRegisterAll_WiresAllFortySources(t *testing.T) {
+// TestRegisterAll_WiresAllFortyFiveSources asserts that RegisterAll registers
+// every Phase 10 + Phase 11 + Phase 12 + Phase 13 + Phase 14 source by its
+// stable name on a fresh engine.
+func TestRegisterAll_WiresAllFortyFiveSources(t *testing.T) {
 	eng := recon.NewEngine()
 	cfg := SourcesConfig{
 		Registry: registerTestRegistry(),
@@ -34,6 +35,7 @@ func TestRegisterAll_WiresAllFortySources(t *testing.T) {
 		"bitbucket",
 		"brave",
 		"censys",
+		"circleci",
 		"codeberg",
 		"codesandbox",
 		"crates",
@@ -44,11 +46,14 @@ func TestRegisterAll_WiresAllFortySources(t *testing.T) {
 		"gist",
 		"gistpaste",
 		"github",
+		"github_actions",
 		"gitlab",
+		"gitlab_ci",
 		"google",
 		"goproxy",
 		"helm",
 		"huggingface",
+		"jenkins",
 		"k8s",
 		"kaggle",
 		"maven",
@@ -66,6 +71,7 @@ func TestRegisterAll_WiresAllFortySources(t *testing.T) {
 		"shodan",
 		"spaces",
 		"terraform",
+		"travisci",
 		"yandex",
 		"zoomeye",
 	}
@@ -85,8 +91,8 @@ func TestRegisterAll_MissingCredsStillRegistered(t *testing.T) {
 		Limiters: recon.NewLimiterRegistry(),
 	})
 
-	if n := len(eng.List()); n != 40 {
-		t.Fatalf("expected 40 sources registered, got %d: %v", n, eng.List())
+	if n := len(eng.List()); n != 45 {
+		t.Fatalf("expected 45 sources registered, got %d: %v", n, eng.List())
 	}
 
 	// SweepAll with an empty config should filter out cred-gated sources