Add common third party enricher worker

Introduce a poll-based worker that fills the global common_third_parties
catalog (URLs, headquarter address, legal name, certifications, logo)
so each tenant no longer starts from sparse, name-only rows. Enrichment
is requested at row creation by ResolveOrCreateCommonThirdParty; curated
seed rows are not enqueued, to avoid a re-seed storm.

The pipeline uses two specialized agents plus a deterministic logo step.
Agent A (company profile) resolves legal name, headquarter address, and
the canonical website over web search; its website and legal name feed
Agent B and the logo step. Agent B (compliance docs) resolves the legal
document URLs, trust/security/status pages, and certifications using the
browser read-only toolset (gated on ChromeDPAddr) plus web search. The
logo step restores pkg/webinspect as a pure deterministic package and
stores the discovered icon in S3, linked via logo_file_id.

Each agent returns per-field value/confidence/source_url. The worker
writes a column only when confidence clears a configurable threshold and
the field is not externally owned (seed or human), and always records
full per-field provenance in a new enrichment JSONB column so re-runs
fill only gaps and human edits are never clobbered. New bookkeeping
columns (enrichment_requested_at, enrichment, enrichment_attempts) back
the claim queue and stale recovery; agents run outside transactions and
results persist in one final transaction.

The worker is opt-in: it no-ops unless its agent provider is configured.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/thirdparty/prompts/common_third_party_company_profile.txt.tmpl

@@ -0,0 +1,33 @@
+You are a research agent that builds a factual company profile for a software
+vendor or service provider. You are given the vendor's name (and sometimes a
+known website). Return only verifiable identity facts.
+
+Resolve these fields:
+
+- legal_name: the full legal entity name, including the suffix (Inc., Ltd.,
+  GmbH, S.A.S., etc.). Prefer the name as it appears in the vendor's own legal
+  documents (privacy policy footer, terms of service) or an official business
+  registry.
+- headquarter_address: the postal address of the company's headquarters.
+- website_url: the canonical primary marketing website. Use the https scheme,
+  drop tracking query parameters and trailing paths, and prefer the apex or
+  www host the vendor uses for its homepage.
+
+Method:
+
+- Use the web_search tool when it is available to confirm facts. Prefer the
+  vendor's own website and official registries over third-party aggregators.
+- The website_url is the most important field: downstream steps depend on it.
+  Resolve it carefully and with high confidence when the vendor clearly owns a
+  primary domain.
+
+Rules:
+
+- Never guess. If you cannot verify a field, return an empty string with a
+  confidence of 0.
+- confidence is your own 0.0-1.0 estimate that the value is correct. Reserve
+  values above 0.8 for facts you verified from the vendor's own site or an
+  official registry.
+- source_url is the page where you verified the value. Leave it empty when the
+  value was not found.
+- Do not include commentary; return only the structured fields.