feat(intel): persist per-provider taxonomy on AttackerIntel for TTP dispatch

The 2026-05-02 ship-time audit of the R0054-R0058 intel rule pack found
that AbuseIPDB / GreyNoise / ThreatFox stored only the aggregate verdict
(score / classification / listed-bool) plus the raw response blob. The
TTP IntelLifter expects per-provider taxonomy fields (categories, tags,
threat_types) that were never populated, so R0054 / R0055 / R0057
emitted zero tags in production despite passing unit tests.

Add typed columns: abuseipdb_categories, greynoise_tags, greynoise_name,
feodo_malware_family, threatfox_threat_types, threatfox_ioc_types,
threatfox_malware_families. Each provider now parses the relevant
taxonomy out of the upstream response and writes it through
column_updates. JSON-list columns ride as TEXT with default "[]" to
keep the SQLite/MySQL backend split honest, deserialised back to native
lists by the repo on read.

decnet/intel/feodo.py

@@ -93,15 +93,21 @@ class FeodoProvider(IntelProvider):
                 verdict=None,  # absence ≠ "benign", let other providers speak
                 column_updates={
                     "feodo_listed": False,
+                    "feodo_malware_family": None,
                     "feodo_raw": "{}",
                     "feodo_queried_at": datetime.now(timezone.utc),
                 },
             )
+        family_obj = entry.get("malware")
+        family = (
+            family_obj if isinstance(family_obj, str) and family_obj else None
+        )
         return IntelResult(
             provider=self.name,
             verdict="malicious",
             column_updates={
                 "feodo_listed": True,
+                "feodo_malware_family": family,
                 "feodo_raw": json.dumps(entry),
                 "feodo_queried_at": datetime.now(timezone.utc),
             },