Refresh ART/STIX at startup and degrade gracefully when offline

[deacon-mp]

Summary

The plugin reads its ATT&CK technique→tactic mapping from enterprise-attack.json, which is not committed here (it's 45 MB) — it arrives only as a side effect of the shallow git clone of Red Canary's atomic-red-team on first boot. Two gaps followed from that:

1. Never refreshed — the --depth 1 clone is frozen at first-boot state; upstream ATT&CK / atomic-test updates never arrive.
2. Not offline-safe — git clone via check_call raised on any network failure, breaking plugin enable; and a missing enterprise-attack.json crashed import with FileNotFoundError.

Changes

clone_atomic_red_team_repo() now ensures the checkout is present and current on every startup:

• missing/empty → shallow clone
• already present → git fetch --depth 1 origin HEAD + fast-forward (git reset --hard FETCH_HEAD) only when behind

This refreshes the atomic tests and the bundled STIX together, and a reset --hard also restores enterprise-attack.json if it went missing.

Everything degrades gracefully:

• offline / git missing / corrupt checkout → log a warning, keep using the on-disk copy; if nothing is on disk, skip import instead of crashing plugin enable.
• _populate_dict_techniques_tactics() tolerates a missing enterprise-attack.json, falling back to the redcanary-unknown tactic.

Testing

• python -m py_compile clean.
• Shallow git fetch --depth 1 origin HEAD + rev-parse comparison verified against a live ART checkout (correctly reports up-to-date).
• Graceful-skip branch confirmed to catch both CalledProcessError (clone/network failure) and OSError (git absent).
• Full server boot with the change: clean start, 1754 atomic abilities imported with full tactic mapping intact — no regression.

🤖 Generated with Claude Code