Add first-party verdict and guards to tracker mapping

The tracker-pattern catalog was binary (linked to a vendor or not), so
generic and first-party artifacts (loglevel keys, wallet-extension keys,
an org's own trackers) were retried forever and, once one row was wrongly
attributed, re-propagated to every organization with no re-check.

Give catalog rows a terminal attribution verdict (UNDETERMINED,
THIRD_PARTY, FIRST_PARTY): FIRST_PARTY short-circuits the whole mapping
pipeline so the artifact is never attributed again. Gate deterministic
vendor adoption behind a trust bar so only curated/operator rows
auto-propagate; lower-confidence agent/heuristic rows are reused as hints
and re-resolved, and an independent agent re-confirmation corroborates and
promotes them. Make the mapping agent emit an evidence source and reject
any attribution that lacks concrete evidence, and let it declare a
first-party verdict. Skip the speculative agent for PRE_EXISTING-source
patterns, whose low signal invites invented vendors.

Add proboctl "ctp mark-first-party" and an --attribution list filter to
audit and remediate existing wrong links, and a cursor rule documenting
migration naming so the timestamp is taken from date -u, not invented.

Signed-off-by: Émile Ré <emile@probo.com>

.cursor/rules/coredata-migrations.mdc

@@ -0,0 +1,36 @@
+---
+description: Coredata SQL migration naming and conventions
+globs: pkg/coredata/migrations/*.sql
+alwaysApply: false
+---
+
+# Coredata migrations
+
+See full guides: `contrib/claude/coredata.md` (Migrations) and
+`contrib/claude/license.md` (SQL header).
+
+## Naming — never invent or infer the timestamp
+
+Migration files use UTC timestamp naming `YYYYMMDDTHHMMSSZ.sql`. The
+timestamp is the **real current time**, obtained by running the command —
+do NOT hand-write a round number (e.g. `...T100000Z`) and do NOT infer the
+next name from existing files.
+
+```bash
+# Run this and use its exact output as the filename:
+date -u +"%Y%m%dT%H%M%SZ.sql"
+```
+
+## License header
+
+Every `.sql` file starts with the ISC header (use the current year). Copy
+the exact block from `contrib/claude/license.md` (SQL section).
+
+## Content rules
+
+- One logical change per file.
+- No indexes by default — add one only when justified by observed
+  production latency. Constraint-enforcing indexes (e.g. unique) are exempt.
+- Avoid `DEFAULT` clauses. When adding a non-nullable column to an existing
+  table, set a `DEFAULT` to backfill existing rows, then `DROP DEFAULT` in
+  the same migration so inserts must supply the value explicitly.