feat: capture cloud region and service, emit structured handoff records

[incendiary]

Matching a resolved address to a provider was only half an answer. "It is an AWS IP" is close to no information: of roughly 10,500 published AWS prefixes, over half carry the generic AMAZON tag, and the ones that matter operationally — EC2 in a named region — were indistinguishable from CDN edge addresses.

All three providers publish region and service alongside every prefix. All of it was being discarded at parse time.

Provider	Publishes	Was kept
AWS	ip_prefix, region, service, network_border_group	prefix only
GCP	ipv4Prefix/ipv6Prefix, service, scope	prefix only
Azure	addressPrefixes, region, systemService	prefixes only

Change

Fetchers now return (ipv4, ipv6, metadata), where metadata maps CIDR to (region, service). CSPIPAddresses carries it and exposes describe(cidr). The matcher retains which prefix an address matched, since that is the key to the metadata.

Each matched address is written as its own record:

domain|ip|provider|region|service|prefix

This file is consumed by other tooling rather than read as prose, so it is now structured fields instead of a sentence, and one line per address instead of a list per domain — addresses under one provider can sit in different regions, and a consumer acts per address.

The run summary groups by provider, region and service for the same reason.

Why it matters, from a live run

CSP matches — AWS: 6  GCP: 0  Azure: 0
  by region and service:
       4  aws  GLOBAL  CLOUDFRONT
       2  aws  GLOBAL  GLOBALACCELERATOR

aws.amazon.com|13.35.163.22|aws|GLOBAL|CLOUDFRONT|13.35.0.0/16
console.aws.amazon.com|99.83.202.243|aws|GLOBAL|GLOBALACCELERATOR|99.83.128.0/17

Previously every one of these read as "resolved to aws IPs". The output now shows they are CDN and Global Accelerator edges rather than EC2 addresses in a region — a distinction that decides whether an address is worth pursuing at all, and one the old format could not express.

Fields are taken verbatim from the provider. Where none is published they read unknown rather than being inferred, and no judgement about what is claimable is encoded — that is the operator1s call.

Compatibility

csp_matches_*.txt changes format. It is a breaking change for anything parsing the old sentence form, documented in the README under Cloud IP attribution and in AGENTS.md. The other output files are untouched.

Legacy Azure caches written before this change hold only the two range lists; they are still read, with metadata simply absent, rather than being discarded.

Tests

Tests that asserted the old prose format now assert the new contract rather than being relaxed. Added: metadata capture per provider, GCP scope mapping to region, the unknown fallback when a provider publishes nothing, Azure global tags reporting global rather than unknown, the end-to-end handoff record, one-record-per-address across differing regions, and the summary breakdown ordering.

251 passed, coverage 95%, ruff clean.