fix: preserve all cloud attributions

[incendiary]

Summary

• preserve every provider-published attribution for duplicate services, overlapping prefixes, identical cross-provider CIDRs, and multi-region ranges
• keep legacy scalar catalogue caches readable without changing the allocator schema
• publish one allocator record per provider, hostname, IP, and provider-published region
• document the goal-aligned roadmap and add a checked external-agent acceptance prompt

Verification

• ruff check .
• ruff format --check .
• baseline: 5 passed
• full suite: 310 passed, 95% coverage for classes and imports
• focused attribution/contract suite: 91 passed
• Gitleaks: no leaks in the commit range
• TruffleHog v3.96.0: zero verified or unverified secrets in the commit range

Live evidence

• production CLI run through the host system resolver against public AWS service names
• current AWS, GCP, and Azure catalogues all complete and usable
• 43 pipe attributions produced; 20 allocator targets validated against allocator-targets-v1.schema.json
• a current S3 address retained its AWS AMAZON, EC2, and S3 attributions

External acceptance still required

• direct 1.1.1.1,8.8.8.8 resolver transport from a host that permits UDP/TCP port 53
• real allocator-consumer compatibility, if that checkout is available

The copy/paste handoff and evidence format are in docs/EXTERNAL-ACCEPTANCE.md. These checks are deliberately outside pytest because repository tests may not make live DNS or HTTP requests.