feat(ttp): rich ThreatActor STIX extensions via CustomExtension + CustomObject

- stix_custom.py: DecnetActorFingerprintExt (@CustomExtension) wrapping
  network_behavior (os_guess/hop_distance/tcp_fingerprint/timing_stats/
  phase_sequence/behavior_class/beacon fields/tool_guesses) and
  protocol_fingerprints (ja3_hashes/hassh_hashes/kex_order_raw/
  ssh_client_banners/tls_cert_sha256/payload_simhashes/c2_endpoints).
  XDecnetBehaveProfile (@CustomObject x-decnet-behave-profile) carrying
  full BEHAVE-SHELL observation envelopes + kd_digraph_simhash.
  FINGERPRINT_EXT_DEF singleton extension-definition SDO.
- Drop legacy flat x_decnet_ja3_hashes / x_decnet_hassh_hashes /
  x_decnet_c2_endpoints (pre-v1, no consumers).
- stix_export: _threat_actor() wired to behavior + observations;
  build_attacker_bundle/build_fleet_bundle grow observations parameter.
- Repo: list_observations_by_attacker + get_all_observations_for_export
  abstract + sqlmodel impl; all four export endpoints extended.
- 18 new tests; inter-DECNET round-trip (stix2.parse → typed objects)
  is the primary fidelity assertion.

tests/db/test_base_repo.py

@@ -111,6 +111,10 @@ class DummyRepo(BaseRepository):
         await super().get_log_histogram(*a, **kw); return []
     async def has_observations_for_evidence(self, evidence_ref):
         await super().has_observations_for_evidence(evidence_ref); return False
+    async def list_observations_by_attacker(self, attacker_uuid):
+        await super().list_observations_by_attacker(attacker_uuid); return []
+    async def get_all_observations_for_export(self):
+        await super().get_all_observations_for_export(); return {}
     async def get_attacker_uuid_by_ip(self, ip):
         await super().get_attacker_uuid_by_ip(ip); return None
     # TTP rollup surface (TTP_TAGGING.md)
@@ -253,6 +257,10 @@ async def test_base_repo_coverage():
     await dr.get_log_histogram()
     with pytest.raises(NotImplementedError):
         await dr.has_observations_for_evidence("shard:x#1")
+    with pytest.raises(NotImplementedError):
+        await dr.list_observations_by_attacker("a")
+    with pytest.raises(NotImplementedError):
+        await dr.get_all_observations_for_export()
     with pytest.raises(NotImplementedError):
         await dr.get_attacker_uuid_by_ip("1.1.1.1")
     with pytest.raises(NotImplementedError):