Add first-party verdict and guards to tracker mapping

The tracker-pattern catalog was binary (linked to a vendor or not), so
generic and first-party artifacts (loglevel keys, wallet-extension keys,
an org's own trackers) were retried forever and, once one row was wrongly
attributed, re-propagated to every organization with no re-check.

Give catalog rows a terminal attribution verdict (UNDETERMINED,
THIRD_PARTY, FIRST_PARTY): FIRST_PARTY short-circuits the whole mapping
pipeline so the artifact is never attributed again. Gate deterministic
vendor adoption behind a trust bar so only curated/operator rows
auto-propagate; lower-confidence agent/heuristic rows are reused as hints
and re-resolved, and an independent agent re-confirmation corroborates and
promotes them. Make the mapping agent emit an evidence source and reject
any attribution that lacks concrete evidence, and let it declare a
first-party verdict. Skip the speculative agent for PRE_EXISTING-source
patterns, whose low signal invites invented vendors.

Add proboctl "ctp mark-first-party" and an --attribution list filter to
audit and remediate existing wrong links, and a cursor rule documenting
migration naming so the timestamp is taken from date -u, not invented.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/proboctl/seed/common-tracker-patterns/common_tracker_patterns.go

@@ -136,6 +136,11 @@ func NewCmdCommonTrackerPatterns(f *cmdutil.Factory) *cobra.Command {
 							continue
 						}
 
+						attribution := coredata.CommonTrackerPatternAttributionUndetermined
+						if thirdPartyID != nil {
+							attribution = coredata.CommonTrackerPatternAttributionThirdParty
+						}
+
 						pattern := coredata.CommonTrackerPattern{
 							ID:                 gid.New(gid.NilTenant, coredata.CommonTrackerPatternEntityType),
 							CommonThirdPartyID: thirdPartyID,
@@ -145,6 +150,7 @@ func NewCmdCommonTrackerPatterns(f *cmdutil.Factory) *cobra.Command {
 							Description:        p.Description,
 							MaxAgeSeconds:      p.MaxAgeSeconds,
 							Confidence:         p.Confidence,
+							Attribution:        attribution,
 							CreatedAt:          now,
 							UpdatedAt:          now,
 						}