Suppress own-domain tracker attribution

Patterns like "ethereum-https://letaido.com" embed the scanned site's
own origin, appended either by a browser extension (e.g. a wallet
injecting window.ethereum) or by an owner-set tracker. The mapping
agent read that embedded domain and attributed the site to itself as a
third party ("Letaido"), but a site owner is never a third party of its
own site.

Pass the scanned site's eTLD+1 to the agent as a <scanned_site> signal
and instruct it to ignore a domain embedded in the pattern that matches
the site, returning low confidence when that is the only cue. Add a
deterministic backstop that discards any agent attribution whose vendor
name resolves to the site's own domain, so the pattern falls through to
the unmatched fallback regardless of whether the model honored the
prompt. Deterministic catalog, naming, and sibling signals run before
the agent and are untouched, so an independent strong vendor signal
still attributes normally.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/cookiebanner/tracker_mapping_agent.go

@@ -171,9 +171,13 @@ func buildTrackerIdentificationPrompt(
 	)
 }
 
-func buildAgentPrompt(tp coredata.TrackerPattern, domains []string) string {
+func buildAgentPrompt(tp coredata.TrackerPattern, domains []string, siteDomain string) string {
 	prompt := buildTrackerIdentificationPrompt(tp.Pattern, tp.TrackerType, tp.MatchType, tp.MaxAgeSeconds)
 
+	if siteDomain != "" {
+		prompt += fmt.Sprintf("<scanned_site> %s </scanned_site>\n", siteDomain)
+	}
+
 	if len(domains) > 0 {
 		prompt += fmt.Sprintf("<observed_domains> %s </observed_domains>\n", strings.Join(domains, ", "))
 	}