feat(ttp): rich ThreatActor STIX extensions via CustomExtension + CustomObject

- stix_custom.py: DecnetActorFingerprintExt (@CustomExtension) wrapping
  network_behavior (os_guess/hop_distance/tcp_fingerprint/timing_stats/
  phase_sequence/behavior_class/beacon fields/tool_guesses) and
  protocol_fingerprints (ja3_hashes/hassh_hashes/kex_order_raw/
  ssh_client_banners/tls_cert_sha256/payload_simhashes/c2_endpoints).
  XDecnetBehaveProfile (@CustomObject x-decnet-behave-profile) carrying
  full BEHAVE-SHELL observation envelopes + kd_digraph_simhash.
  FINGERPRINT_EXT_DEF singleton extension-definition SDO.
- Drop legacy flat x_decnet_ja3_hashes / x_decnet_hassh_hashes /
  x_decnet_c2_endpoints (pre-v1, no consumers).
- stix_export: _threat_actor() wired to behavior + observations;
  build_attacker_bundle/build_fleet_bundle grow observations parameter.
- Repo: list_observations_by_attacker + get_all_observations_for_export
  abstract + sqlmodel impl; all four export endpoints extended.
- 18 new tests; inter-DECNET round-trip (stix2.parse → typed objects)
  is the primary fidelity assertion.

decnet/ttp/misp_export.py

@@ -47,6 +47,7 @@ def build_attacker_misp_event(
     artifacts: list[dict[str, Any]],
     smtp_targets: list[dict[str, Any]],
     commands: list[str] | None = None,
+    observations: list[dict[str, Any]] | None = None,
 ) -> dict[str, Any]:
     """Return a MISP event dict for *attacker*.
 
@@ -63,6 +64,7 @@ def build_attacker_misp_event(
         artifacts=artifacts,
         smtp_targets=smtp_targets,
         commands=commands,
+        observations=observations,
     )
     return _parse_bundle(bundle)
 
@@ -70,6 +72,7 @@ def build_attacker_misp_event(
 def build_fleet_misp_collection(
     rows: list[dict[str, Any]],
     ttp_by_attacker: dict[str, list[dict[str, Any]]],
+    observations_by_attacker: dict[str, list[dict[str, Any]]] | None = None,
 ) -> dict[str, Any]:
     """Return a MISP collection dict with one event per attacker in *rows*.
 
@@ -80,6 +83,7 @@ def build_fleet_misp_collection(
     attacker always has at least an IP) are silently omitted.
     """
     events: list[dict[str, Any]] = []
+    obs_map = observations_by_attacker or {}
     for row in rows:
         raw_cmds = row.get("commands") or []
         if isinstance(raw_cmds, str):
@@ -102,6 +106,7 @@ def build_fleet_misp_collection(
             artifacts=[],
             smtp_targets=[],
             commands=cmds,
+            observations=obs_map.get(row["uuid"]),
         )
         event = _parse_bundle(bundle)
         if event: