feat(intel): persist per-provider taxonomy on AttackerIntel for TTP dispatch

The 2026-05-02 ship-time audit of the R0054-R0058 intel rule pack found
that AbuseIPDB / GreyNoise / ThreatFox stored only the aggregate verdict
(score / classification / listed-bool) plus the raw response blob. The
TTP IntelLifter expects per-provider taxonomy fields (categories, tags,
threat_types) that were never populated, so R0054 / R0055 / R0057
emitted zero tags in production despite passing unit tests.

Add typed columns: abuseipdb_categories, greynoise_tags, greynoise_name,
feodo_malware_family, threatfox_threat_types, threatfox_ioc_types,
threatfox_malware_families. Each provider now parses the relevant
taxonomy out of the upstream response and writes it through
column_updates. JSON-list columns ride as TEXT with default "[]" to
keep the SQLite/MySQL backend split honest, deserialised back to native
lists by the repo on read.

decnet/intel/greynoise.py

@@ -71,6 +71,8 @@ class GreyNoiseProvider(IntelProvider):
                 verdict="unknown",
                 column_updates={
                     "greynoise_classification": "unknown",
+                    "greynoise_name": None,
+                    "greynoise_tags": "[]",
                     "greynoise_raw": json.dumps({"message": "not seen"}),
                     "greynoise_queried_at": datetime.now(timezone.utc),
                 },
@@ -88,11 +90,24 @@ class GreyNoiseProvider(IntelProvider):
 
         classification = (data.get("classification") or "unknown").lower()
         verdict = _CLASSIFICATION_TO_VERDICT.get(classification, "unknown")
+        # The Community endpoint surfaces an actor ``name`` (e.g. "Tor",
+        # "Censys") but no behavioral tag list — the tag taxonomy is
+        # paid-tier only. Persist whatever we got; a future non-Community
+        # provider may populate ``greynoise_tags``.
+        name_obj = data.get("name")
+        name = name_obj if isinstance(name_obj, str) and name_obj else None
+        tags_obj = data.get("tags")
+        tags: list[str] = (
+            [t for t in tags_obj if isinstance(t, str)]
+            if isinstance(tags_obj, list) else []
+        )
         return IntelResult(
             provider=self.name,
             verdict=verdict,
             column_updates={
                 "greynoise_classification": classification,
+                "greynoise_name": name,
+                "greynoise_tags": json.dumps(tags),
                 "greynoise_raw": json.dumps(data),
                 "greynoise_queried_at": datetime.now(timezone.utc),
             },