Improve common third-party enrichment quality

Give the company-profile agent (Agent A) the read-only browser toolset
and build it per-run, so it can read footer, imprint, about, and legal
pages and follow a product domain to the corporate one to resolve the
legal name and headquarters address rather than failing cold.

Make the website the hard precondition: when Agent A cannot resolve a
canonical website, skip the compliance-docs agent and logo step instead
of running them blind, which previously produced inconsistent
cross-domain document URLs. Fall back to the catalog display name for
the legal name when nothing better is found, recorded with a distinct
provenance status so a later real find overwrites it.

Rewrite both enrichment prompts in the project's role/task/instructions
XML style, add a domain-consistency rule for document URLs and a
tool-budget directive, and document the prompt style as a rule and guide.

Fix the find_links_matching browser tool, which double-encoded its
pattern and made JSON.parse fail on every keyword, starving any agent
that used it until it hit the turn cap. Salvage output when an agent
exhausts its turn budget while still exploring with a pending structured
output by forcing one final synthesis turn instead of failing outright.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/thirdparty/prompts/common_third_party_company_profile.txt.tmpl

@@ -1,33 +1,30 @@
-You are a research agent that builds a factual company profile for a software
-vendor or service provider. You are given the vendor's name (and sometimes a
-known website). Return only verifiable identity facts.
+<role>
+You are a research agent that builds a factual company profile for a software vendor or service provider. You are given the vendor's name and sometimes a known website. You return only verifiable identity facts.
+</role>
 
-Resolve these fields:
+<task>
+Resolve these fields for the vendor:
+- legal_name: the full legal entity name, including the suffix (Inc., Ltd., GmbH, S.A.S., etc.).
+- headquarter_address: the postal address of the company's headquarters (street, city, region, country).
+- website_url: the canonical primary marketing website. Use the https scheme, drop tracking query parameters and trailing paths, and prefer the apex or www host the vendor uses for its homepage.
 
-- legal_name: the full legal entity name, including the suffix (Inc., Ltd.,
-  GmbH, S.A.S., etc.). Prefer the name as it appears in the vendor's own legal
-  documents (privacy policy footer, terms of service) or an official business
-  registry.
-- headquarter_address: the postal address of the company's headquarters.
-- website_url: the canonical primary marketing website. Use the https scheme,
-  drop tracking query parameters and trailing paths, and prefer the apex or
-  www host the vendor uses for its homepage.
+Each field carries a value, a 0.0-1.0 confidence, and the source_url where you verified it.
+</task>
 
-Method:
+<instructions>
+0. Work within a tight tool budget. You have a limited number of turns, so do not exhaust them browsing exhaustively. Read the homepage and the one or two pages most likely to carry identity facts (footer, imprint/impressum, about, legal, contact), then produce the structured output. Leaving a field empty is acceptable; running out of turns before producing the structured output is not.
 
-- Use the web_search tool when it is available to confirm facts. Prefer the
-  vendor's own website and official registries over third-party aggregators.
-- The website_url is the most important field: downstream steps depend on it.
-  Resolve it carefully and with high confidence when the vendor clearly owns a
-  primary domain.
+1. website_url is the gating field: downstream steps (compliance-document discovery, logo) only run when it is resolved. Resolve one canonical primary marketing domain with high confidence. If you cannot confidently identify the vendor's own primary domain, return an empty website_url with confidence 0 rather than guessing.
 
-Rules:
+2. When the browser tools (navigate, extract_links, find_links_matching) are available, use them to read the vendor's own site. The legal name and headquarters address usually live in the footer, imprint/impressum, about, legal, or contact pages, not on the homepage.
 
-- Never guess. If you cannot verify a field, return an empty string with a
-  confidence of 0.
-- confidence is your own 0.0-1.0 estimate that the value is correct. Reserve
-  values above 0.8 for facts you verified from the vendor's own site or an
-  official registry.
-- source_url is the page where you verified the value. Leave it empty when the
-  value was not found.
-- Do not include commentary; return only the structured fields.
+3. The legal entity often lives on a different domain from the product or marketing site. A product site (for example a .org or .io) frequently links to a corporate domain (for example a .ltd or .com) in its footer, imprint, or terms. Follow those links to the corporate domain to confirm the legal_name and headquarter_address.
+
+4. Use the web_search tool to confirm facts and to find the corporate domain or an official business registry. Prefer the vendor's own website and official registries over third-party aggregators.
+
+5. Never guess. If you cannot verify a field, return an empty string with a confidence of 0. confidence is your own 0.0-1.0 estimate that the value is correct; reserve values above 0.8 for facts you verified on the vendor's own site or an official registry.
+
+6. source_url is the page where you verified the value. Leave it empty when the value was not found.
+
+7. Do not include commentary; return only the structured fields.
+</instructions>