feat: add 30 takeover fingerprints and lock the pattern set with tests

[incendiary]

An unrecognised CNAME target is reported as unknown, so a missing fingerprint turns a genuine takeover candidate into a line nobody can act on. The set covered 60 services; this adds 30 well-established ones that were absent, cross-referenced against the community project "can-i-take-over-xyz" by EdOverflow.

Added

Webflow, Helpjuice, Help Scout, Cargo Collective, UserVoice, Tilda, Big Cartel, Campaign Monitor, Intercom, Thinkific, Canny, Kajabi, Gemfury, Frontify, Aha!, Brightcove, Wishpond, GetResponse, Agile CRM, ReadMe, Hatena Blog, SmugMug, SurveyGizmo, FeedPress, Simplebooklet, Vend, JetBrains YouTrack, Kinsta, Short.io and Pingdom.

Each carries a regex, a recommendation naming the action to take, and an evidence link, matching the existing entries. Only fingerprints that are well established were included — nothing speculative.

New patterns are appended, so existing fingerprints keep precedence under first-match-wins.

Tests for the pattern set

The pattern set had no tests of its own, despite being the thing that decides whether a finding is actionable. Added:

• a representative target per fingerprint asserting it classifies to its own category — this catches both a broken regex and a pattern shadowed by an earlier one;
• an unmatched target still reports honestly as unknown rather than being guessed at;
• every entry carries the three fields the output line depends on, and every regex compiles.

Targets are written out explicitly rather than generated from the regexes, so a broken pattern cannot make its own test pass.

243 passed, ruff clean. Existing classifications verified unchanged (Heroku, GitHub Pages, AWS ELB, S3, Azure, Incapsula).

Part of the review roadmap (item PR-F, task F3) — see ROADMAP.md.