refactor(prober): ActiveProbe ABC + ActiveProbeMeta registry

Replace _jarm_phase / _hassh_phase / _tcpfp_phase boilerplate (3×~50
lines of identical port-iteration logic) with a metaclass-registered ABC.
Adding a new port-iterating active probe is now one class + three methods.

- decnet/prober/base.py: ActiveProbeMeta auto-registers subclasses by
  probe_name; ActiveProbe ABC enforces run/syslog_fields/publish_payload
  with env-driven DECNET_PROBE_PORTS_<NAME> port override.
- decnet/prober/probes/{jarm,hassh,tcpfp}.py: concrete probe classes.
- decnet/prober/worker.py: single _run_probe driver replaces the three
  phase functions; _probe_cycle iterates ActiveProbeMeta.all(); drops
  the ports=/ssh_ports=/tcpfp_ports= kwargs from prober_worker.
- IPv6 leak and TLS cert capture stay as special cases (different call
  shapes; intentionally outside the registry).
- tests/prober/test_active_probe_registry.py: registry contents, sort
  order, priority-10 override, ABC contract per probe class.
- tests/prober/test_run_probe_driver.py: dedup, success, None-skip,
  exception, rotation, publish paths for _run_probe.
- tests/prober/test_prober_worker.py: updated patch targets and
  _probe_cycle call sites; port control via monkeypatch.setattr.

decnet/prober/probes/hassh.py

@@ -0,0 +1,41 @@
+from __future__ import annotations
+
+from typing import Any
+
+from decnet.prober.base import ActiveProbe
+from decnet.prober.hassh import hassh_server
+from decnet.telemetry import traced as _traced
+
+DEFAULT_PORTS: list[int] = [22, 2222, 22222, 2022]
+
+
+class HasshProbe(ActiveProbe):
+    probe_name = "hassh"
+    default_ports = DEFAULT_PORTS
+    event_type = "hassh_fingerprint"
+    rotation_type = "hassh"
+    rotation_hash_key = "hassh_server"
+    priority = 100
+
+    @_traced("prober.hassh_probe")
+    def run(self, ip: str, port: int, timeout: float) -> dict[str, Any] | None:
+        return hassh_server(ip, port, timeout=timeout)
+
+    def syslog_fields(self, ip: str, port: int, result: dict[str, Any]) -> tuple[dict[str, Any], str]:
+        fields = {
+            "hassh_server_hash": result["hassh_server"],
+            "ssh_banner": result["banner"],
+            "kex_algorithms": result["kex_algorithms"],
+            "encryption_s2c": result["encryption_s2c"],
+            "mac_s2c": result["mac_s2c"],
+            "compression_s2c": result["compression_s2c"],
+        }
+        return fields, f"HASSH {ip}:{port} = {result['hassh_server']}"
+
+    def publish_payload(self, ip: str, port: int, result: dict[str, Any]) -> dict[str, Any]:
+        return {
+            "attacker_ip": ip,
+            "port": port,
+            "hassh_server": result["hassh_server"],
+            "ssh_banner": result["banner"],
+        }