fix(ttp): correct stale clip tests to ceiling semantics + document ATTACKER_FINGERPRINTED topic

confidence_max is a ceiling (min(base, ceiling)), not a multiplier — the
ASVS pass fixed this (BUG-8: min(base, base*ceiling) -> min(base, ceiling)),
but 4 lifter clip tests still encoded the old base*ceiling math (0.45/0.4/
0.35) and were masked by the make test-web bundle error fail-fast. All four
now assert the 0.5 ceiling. Separately, test_topics_matches_documented_set
lacked attacker.fingerprinted, which worker.py legitimately subscribes to
(JARM/HASSH/tcpfp/ipv6_leak -> TTP tagging). Located via turbovec + git pickaxe.

(cherry picked from commit f83b467c35649a06fa36f4b350e6666379cd71cb)

tests/ttp/test_credential_lifter.py

@@ -179,8 +179,8 @@ def test_clipped_rule_caps_confidence() -> None:
         "credential_hash": "x", "reuse_count": 3,
     })))
     assert len(out) == 1
-    # Base 0.9 × 0.5 ceiling.
-    assert out[0].confidence == pytest.approx(0.45)
+    # Base 0.9 capped at the 0.5 ceiling — min(0.9, 0.5).
+    assert out[0].confidence == pytest.approx(0.5)
 
 
 # ── Ownership predicate ─────────────────────────────────────────────