feat(intel): persist per-provider taxonomy on AttackerIntel for TTP dispatch

The 2026-05-02 ship-time audit of the R0054-R0058 intel rule pack found
that AbuseIPDB / GreyNoise / ThreatFox stored only the aggregate verdict
(score / classification / listed-bool) plus the raw response blob. The
TTP IntelLifter expects per-provider taxonomy fields (categories, tags,
threat_types) that were never populated, so R0054 / R0055 / R0057
emitted zero tags in production despite passing unit tests.

Add typed columns: abuseipdb_categories, greynoise_tags, greynoise_name,
feodo_malware_family, threatfox_threat_types, threatfox_ioc_types,
threatfox_malware_families. Each provider now parses the relevant
taxonomy out of the upstream response and writes it through
column_updates. JSON-list columns ride as TEXT with default "[]" to
keep the SQLite/MySQL backend split honest, deserialised back to native
lists by the repo on read.

tests/intel/test_abuseipdb.py

@@ -95,6 +95,50 @@ async def test_low_score_maps_to_benign(monkeypatch):
     assert result.column_updates["abuseipdb_score"] == 0
 
 
+@pytest.mark.anyio
+async def test_categories_flattened_from_reports(monkeypatch):
+    """Post-2026-05-02 audit: provider must extract the union of
+    ``data.reports[*].categories`` so the IntelLifter can dispatch
+    ATT&CK techniques. Sorted for deterministic test + bus diff."""
+    monkeypatch.setenv("DECNET_ABUSEIPDB_API_KEY", "k3y")
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            200,
+            json={"data": {
+                "abuseConfidenceScore": 80,
+                "reports": [
+                    {"categories": [18, 22]},
+                    {"categories": [22, 14]},
+                    {"categories": []},
+                    {"not_a_dict": True},
+                    {"categories": [21]},
+                ],
+            }},
+        )
+
+    _install_transport(handler)
+    provider = AbuseIPDBProvider()
+    result = await provider.lookup("1.2.3.4")
+    cats = json.loads(result.column_updates["abuseipdb_categories"])
+    assert cats == [14, 18, 21, 22]
+
+
+@pytest.mark.anyio
+async def test_categories_empty_when_no_reports(monkeypatch):
+    monkeypatch.setenv("DECNET_ABUSEIPDB_API_KEY", "k3y")
+
+    async def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            200, json={"data": {"abuseConfidenceScore": 5}},
+        )
+
+    _install_transport(handler)
+    provider = AbuseIPDBProvider()
+    result = await provider.lookup("8.8.8.8")
+    assert json.loads(result.column_updates["abuseipdb_categories"]) == []
+
+
 @pytest.mark.anyio
 async def test_429_returns_error(monkeypatch):
     monkeypatch.setenv("DECNET_ABUSEIPDB_API_KEY", "k3y")