Add common third party enricher worker

Introduce a poll-based worker that fills the global common_third_parties
catalog (URLs, headquarter address, legal name, certifications, logo)
so each tenant no longer starts from sparse, name-only rows. Enrichment
is requested at row creation by ResolveOrCreateCommonThirdParty; curated
seed rows are not enqueued, to avoid a re-seed storm.

The pipeline uses two specialized agents plus a deterministic logo step.
Agent A (company profile) resolves legal name, headquarter address, and
the canonical website over web search; its website and legal name feed
Agent B and the logo step. Agent B (compliance docs) resolves the legal
document URLs, trust/security/status pages, and certifications using the
browser read-only toolset (gated on ChromeDPAddr) plus web search. The
logo step restores pkg/webinspect as a pure deterministic package and
stores the discovered icon in S3, linked via logo_file_id.

Each agent returns per-field value/confidence/source_url. The worker
writes a column only when confidence clears a configurable threshold and
the field is not externally owned (seed or human), and always records
full per-field provenance in a new enrichment JSONB column so re-runs
fill only gaps and human edits are never clobbered. New bookkeeping
columns (enrichment_requested_at, enrichment, enrichment_attempts) back
the claim queue and stale recovery; agents run outside transactions and
results persist in one final transaction.

The worker is opt-in: it no-ops unless its agent provider is configured.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/thirdparty/common_third_party_company_profile_agent.go

@@ -0,0 +1,94 @@
+// Copyright (c) 2026 Probo Inc <hello@getprobo.com>.
+//
+// Permission to use, copy, modify, and/or distribute this software for any
+// purpose with or without fee is hereby granted, provided that the above
+// copyright notice and this permission notice appear in all copies.
+//
+// THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+// REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+// AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+// INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+// LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+// OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+// PERFORMANCE OF THIS SOFTWARE.
+
+package thirdparty
+
+import (
+	_ "embed"
+	"fmt"
+	"strings"
+
+	"go.gearno.de/kit/log"
+	"go.probo.inc/probo/pkg/agent"
+	"go.probo.inc/probo/pkg/agent/tools/search"
+	"go.probo.inc/probo/pkg/coredata"
+)
+
+//go:embed prompts/common_third_party_company_profile.txt.tmpl
+var companyProfilePrompt string
+
+// CompanyProfileResult is the structured output of the company-profile
+// agent (Agent A): the vendor's identity facts. website_url is the key
+// signal the compliance-docs agent and the logo step depend on, so it is
+// resolved here first.
+type CompanyProfileResult struct {
+	LegalName          EnrichedField `json:"legal_name" jsonschema:"The vendor's full legal company name including the entity suffix (e.g. 'Acme Technologies, Inc.')."`
+	HeadquarterAddress EnrichedField `json:"headquarter_address" jsonschema:"The vendor's headquarters postal address (street, city, region, country)."`
+	WebsiteURL         EnrichedField `json:"website_url" jsonschema:"The vendor's canonical primary marketing website URL (https scheme, no tracking query parameters, no trailing path)."`
+}
+
+func buildCompanyProfileAgent(
+	cfg EnrichmentConfig,
+	logger *log.Logger,
+) *agent.Agent {
+	var tools []agent.Tool
+
+	if cfg.FirecrawlAPIKey != "" {
+		tools = append(tools, search.FirecrawlSearchTool(cfg.FirecrawlAPIKey))
+	}
+
+	outputType, err := agent.NewOutputType[CompanyProfileResult]("common_third_party_company_profile")
+	if err != nil {
+		panic(fmt.Sprintf("thirdparty: cannot build company profile output type: %s", err))
+	}
+
+	opts := []agent.Option{
+		agent.WithInstructions(companyProfilePrompt),
+		agent.WithModel(cfg.Model),
+		agent.WithOutputType(outputType),
+		agent.WithMaxTurns(resolveEnrichmentMaxTurns(cfg.MaxTurns)),
+		agent.WithMaxTokens(resolveEnrichmentMaxTokens(cfg.MaxTokens)),
+		agent.WithLogger(logger),
+	}
+
+	if len(tools) > 0 {
+		opts = append(opts, agent.WithTools(tools...))
+	}
+
+	if cfg.Temperature != nil {
+		opts = append(opts, agent.WithTemperature(*cfg.Temperature))
+	}
+
+	return agent.New("common-third-party-company-profile", cfg.LLMClient, opts...)
+}
+
+// buildCompanyProfilePrompt renders the per-row input for Agent A. Any
+// values already on the row are passed as hints so the agent confirms or
+// corrects them rather than starting cold.
+func buildCompanyProfilePrompt(party coredata.CommonThirdParty) string {
+	var b strings.Builder
+
+	fmt.Fprintf(&b, "Research this company and return its profile.\n\n")
+	fmt.Fprintf(&b, "<name> %s </name>\n", party.Name)
+
+	if party.WebsiteURL != nil && strings.TrimSpace(*party.WebsiteURL) != "" {
+		fmt.Fprintf(&b, "<known_website> %s </known_website>\n", *party.WebsiteURL)
+	}
+
+	if party.LegalName != nil && strings.TrimSpace(*party.LegalName) != "" {
+		fmt.Fprintf(&b, "<known_legal_name> %s </known_legal_name>\n", *party.LegalName)
+	}
+
+	return b.String()
+}