Is AI Agent automated penetration testing legal? Authorization boundaries, Strix-style tools, and compliance checklist