fix: 外部审查 8 项修复 + 国密 TLS 按需回退

- UserAgent 默认值回退 + 注册 -ua flag (#2)
- README 编译命令 main.go → . (#3)
- README 版本号同步 rc.1 (#4)
- Client.go gmtls stdout 劫持删除 (#5)
- ms17010 smb1GetResponse size<32 越界 panic (#6)
- SSH 拨号超时统一 ModuleTimeout (#8)
- AddPorts 死字段删除 (#9)
- 国密 TLS 按需回退：标准 TLS 握手失败时仅在错误为
  cipher/protocol 不兼容时尝试国密，跳过超时/拒绝等连接级错误

core/web_scanner.go

@@ -56,19 +56,21 @@ func DetectHTTPSchemeContext(ctx context.Context, host string, port int, config
 		return "https"
 	}
 
-	// 第二步：尝试国密TLS握手（GM TLS fallback）
-	gmConn, gmErr := gmtls.DialWithDialer(
-		tlsDialer,
-		"tcp", addr,
-		&gmtls.Config{
-			GMSupport:          gmtls.NewGMSupport(),
-			InsecureSkipVerify: true,
-		},
-	)
-
-	if gmErr == nil {
-		_ = gmConn.Close()
-		return "https-gm"
+	// 第二步：仅在标准 TLS 握手级别失败（cipher/protocol 不兼容）时尝试国密
+	// 连接级别失败（timeout/refused/非 TLS 端口）不需要尝试
+	if maybeGMTLS(err) {
+		gmConn, gmErr := gmtls.DialWithDialer(
+			tlsDialer,
+			"tcp", addr,
+			&gmtls.Config{
+				GMSupport:          gmtls.NewGMSupport(),
+				InsecureSkipVerify: true,
+			},
+		)
+		if gmErr == nil {
+			_ = gmConn.Close()
+			return "https-gm"
+		}
 	}
 
 	// TLS和GM TLS都失败，尝试HTTP
@@ -491,6 +493,20 @@ func (s *WebScanStrategy) createTargetFromURLWithSession(baseInfo common.HostInf
 	return &urlInfo
 }
 
+// maybeGMTLS 判断标准 TLS 握手错误是否可能是国密服务端
+// 只有 cipher/protocol 层面的不兼容才值得尝试国密回退
+// 连接超时、拒绝、非 TLS 端口等连接级错误直接跳过
+func maybeGMTLS(err error) bool {
+	if err == nil {
+		return false
+	}
+	s := err.Error()
+	return strings.Contains(s, "handshake failure") ||
+		strings.Contains(s, "protocol version") ||
+		strings.Contains(s, "no mutual") ||
+		strings.Contains(s, "cipher suite")
+}
+
 func hasMalformedURLPort(host string) bool {
 	if strings.HasPrefix(host, "[") {
 		end := strings.LastIndexByte(host, ']')