Validate tuning inputs; remove dead pass block (audit fixes #989)

- _prompt() clamps non-positive tuning values to default with operator warning
  (HIGH from AUDIT_SEC_989: prevents garbage display when vars file has
  masscan_rate: -100 or nuclei_concurrency: 0)
- Remove empty 'if scan_mode in (...): pass' placeholder left from refactor
  (P3 from AUDIT_CODE_989)
- Add AUDIT_CODE/SEC/ENV_989.md and FIXES_989.md with skip justifications
  (path traversal not applicable to single-operator threat model;
  Tor wording already adequate; estimate disclosure interactive-only)

modules/webrunner/deploy_webrunner.py

@@ -184,17 +184,21 @@ def _get_tuning_params(scan_mode: str, default_rate: int, vars_overrides: dict)
             print(f"\n{COLORS['BLUE']}Advanced Tuning (Enter = use default):{COLORS['RESET']}")
             show_header = False
         if key in vars_overrides:
-            tuning[key] = cast(vars_overrides[key])
-            print(f"  {label}: {tuning[key]} (vars file)")
+            value = cast(vars_overrides[key])
+            source = "vars file"
         else:
             raw = input(f"  {label} [{default}]: ").strip()
-            tuning[key] = cast(raw) if raw else default
+            value = cast(raw) if raw else default
+            source = None
+        if isinstance(value, (int, float)) and value <= 0:
+            print(f"{COLORS['YELLOW']}    {label}={value} invalid (must be > 0); using default {default}{COLORS['RESET']}")
+            value = default
+        tuning[key] = value
+        if source:
+            print(f"  {label}: {value} ({source})")
 
     _prompt("masscan rate (pkt/s)", "masscan_rate", default_rate)
 
-    if scan_mode in ('masscan+nmap', 'geo-scout', 'masscan+nuclei'):
-        pass  # masscan_rate already handled
-
     if scan_mode in ('masscan+nmap', 'geo-scout'):
         _prompt("nmap timing T1-T4", "nmap_timing", 4)
         _prompt("nmap per-host timeout (s)", "nmap_timeout", 60)