fix: keep wildcard answers out of cloud targets, capture border group

[incendiary]

Two gaps in the cloud-matching path — the half of this tool that has no commodity equivalent.

1. Wildcard answers were counted as cloud targets

perform_csp_checks ran with no idea whether the resolution had come from a zone wildcard. A catch-all address belongs to the hosting platform and is in active use, so it is the opposite of a claimable target — yet a single wildcarded zone sitting in cloud space emitted one record per enumerated subdomain, each a distinct line and therefore none deduplicated. On a real enumeration that buries the findings under the platform1s own addresses.

The wildcard verdict now travels with the cloud match. Those records get a WILDCARD| prefix, consistent with the resolution output, and the summary reports them separately instead of counting them as targets:

CSP matches — AWS: 8  GCP: 0  Azure: 0
  excluded (wildcard) :    3  (hosting platform addresses, not targets)
  by region and service:
       4  aws  GLOBAL  CLOUDFRONT
       4  aws  us-east-1  EC2

They are marked, not dropped — no judgement about what is worth pursuing belongs in this tool.

2. AWS network border group was being discarded

It is the boundary an Elastic IP is actually allocated and advertised from, which is exactly the scope a consumer of this output would operate within. It usually mirrors the region but diverges for Local Zones and Wavelength, which is where knowing it matters.

domain|ip|provider|region|service|prefix|border_group

GCP and Azure publish no equivalent; it reads unknown for them, rather than being inferred from the region.

Verified live, including what it does not do

Run against a wildcarded zone inside AWS space. It worked — and exposed the limit of the approach, which is worth stating plainly rather than leaving to be discovered:

WILDCARD|another-fake-qq31z.herokuapp.com|34.241.115.67|aws|eu-west-1|EC2|...
         nonexistent-zz9x7q.herokuapp.com|23.22.144.165|aws|us-east-1|EC2|...   <- missed

Both names are fabricated. Where a catch-all is served by a large rotating fleet, two probes observe only part of the rotation, so a later name landing elsewhere in that fleet is not recognised. A match is good evidence; a miss is not evidence of absence. Documented in the README and AGENTS.md.

A zone-level semantic — marking every resolution in a zone known to answer for anything, rather than testing each address against a sampled set — would be more robust, and arguably more honest given DNS cannot discriminate within such a zone anyway. That is an open design decision and deliberately not slipped in here.

Compatibility

csp_matches_*.txt gains a seventh field and an optional line prefix. Breaking for anything parsing the six-field form shipped in the previous PR.

255 passed, ruff clean. New tests cover the marking, the unmarked default for existing callers, and the summary excluding wildcard records from target counts.