P3: Add process tree analysis tool for parent-child correlation

[Shreyas582]

Description

The current tool suite has list_processes (via tasklist) but no process tree analysis. Security triage frequently needs to identify suspicious parent-child relationships (e.g., cmd.exe spawned by svchost.exe, powershell.exe spawned by excel.exe).

Without tree context, the agent can list processes but cannot correlate them into attack chains.

Proposal

Add a process_tree tool that:

1. On Windows: uses wmic process get Name,ProcessId,ParentProcessId or Get-CimInstance Win32_Process
2. On Linux: uses ps auxf or pstree
3. Returns parent-child relationships in structured format
4. Optionally highlights known suspicious parent-child pairs (MITRE T1059, T1055)

Affected Files

• cyber_tools/src/lib.rs (new tool)
• core_engine/src/lib.rs (tool registry)