Review an attack path

What this does

Three modes against the SubImage attack-path engine and the underlying Neo4j graph:

1. Walk a known path in plain English, surface the most sensitive terminal asset, and propose the fastest fix.
2. Pivot from an asset to find which paths it sits on and review the worst.
3. Hunt for n+1 extensions: probe the graph past a path's terminal node to find credible next steps the engine has not yet modeled, and surface them inline as candidate transitions.

Optional what-if simulation overlays any of the above.

When to use

✅ User has an attack path id from the SubImage UI or a list response. ✅ User has an asset and wants to know if it is on any path. ✅ User wants to extend an existing path: "find lateral movement from here", "assess blast radius of ", "what could come next". ✅ User wants a what-if: "if attacker compromises X, what happens?". ✅ User just finished subimage-mcp:investigate-cve and confirmed the pivot.