Harden catalog vendor resolution and agent prompt

Address review feedback on the agent-driven tracker catalog path:

- Return initiator-domain load failures instead of swallowing them,
  so the worker retries rather than running the agent on partial
  context.
- In the resolver, treat only ErrResourceNotFound as a catalog miss
  and propagate genuine name/slug lookup errors.
- Insert the new vendor inside a savepoint and, on the slug
  unique-violation race, reload and return the winning row instead of
  aborting the caller's transaction.
- Stop seeding common_third_party_domains from observed initiator
  domains. They are a co-occurrence signal, not verified ownership,
  and writing them into the global cross-tenant catalog pollutes the
  domain-based matcher. The curated seed owns that data.
- Warn the mapping agent that observed domains may belong to shared
  CDNs, tag managers, or hosting infrastructure rather than the
  vendor, so it does not attribute on that basis alone.
- Extract a shared tracker-identification prompt helper and move the
  common-pattern identification prompt next to the enrichment agent.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/thirdparty/resolver_test.go

@@ -145,7 +145,6 @@ func TestResolveOrCreateCommonThirdParty(t *testing.T) {
 				logger,
 				name,
 				coredata.ThirdPartyCategoryAnalytics,
-				nil,
 			)
 			got = id
 
@@ -175,7 +174,6 @@ func TestResolveOrCreateCommonThirdParty(t *testing.T) {
 				logger,
 				variant,
 				coredata.ThirdPartyCategoryAnalytics,
-				nil,
 			)
 			got = id
 
@@ -199,7 +197,6 @@ func TestResolveOrCreateCommonThirdParty(t *testing.T) {
 				logger,
 				name,
 				coredata.ThirdPartyCategoryMarketing,
-				nil,
 			)
 			got = id