test(clustering): factory honors ip_pool: rotating + 3-level truth labels

Fifth and final commit of the identity-resolution substrate. Unblocks
fixture 2 (vpn_hopping) by making the synthetic factory match
production shape: an actor rotating across N IPs produces N
SyntheticAttacker rows that share fingerprints + truth_identity_id but
differ on ip / asn — exactly the shape the future clusterer needs to
recover via JA3/HASSH match.

Factory:
* SyntheticSession + SyntheticAttacker gain truth_identity_id field.
* DSL: ip_pool: rotating + rotation_count: N produces N observation
  rows per actor. Optional rotation_asns: [...] cycles ASN per row;
  defaults to the actor's primary asn.
* Sessions distribute round-robin across the actor's rotated rows.
* Noise scanners get truth_identity_id == truth_actor_id ==
  truth_campaign_id (each is its own singleton at every level).
* GeneratedCorpus.truth_labels(level=) accepts "campaign" (default,
  back-compat), "identity", or "actor" — picks the oracle the
  metric harness scores against.

Harness:
* assert_fixture_bounds gains truth_level kwarg (default "campaign")
  so identity-resolution fixtures can score against truth_identity_id
  without churning the campaign-clustering test files.

Tests: 9 new (rotation_count emits N rows, shared identity +
fingerprints, distinct IPs, rotation_asns distribution + cycling,
round-robin session distribution, identity-level truth labels,
sticky default unchanged, sessions inherit identity label).
598 tests green across clustering / factories / db / web / bus /
profiler / correlation.

tests/clustering/fixture_harness.py

@@ -36,16 +36,23 @@ def assert_fixture_bounds(
     corpus: GeneratedCorpus,
     predict: PredictFn,
     expected_path: str | Path,
+    *,
+    truth_level: str = "campaign",
 ) -> dict[str, float]:
     """
     Run `predict` against the corpus, score against ground truth, and
     assert every metric meets the floor declared in `expected_path`.
 
+    ``truth_level`` selects the oracle: ``"campaign"`` (default) for
+    campaign-clustering fixtures, ``"identity"`` for identity-resolution
+    fixtures (where the clusterer's job is to fold N rotated-IP
+    observations into one identity), or ``"actor"`` for completeness.
+
     Returns the observed metrics dict so callers can do additional
     assertions (e.g. "homogeneity is *exactly* 1.0 for this fixture").
     """
     bounds = yaml.safe_load(Path(expected_path).read_text(encoding="utf-8"))
-    truth = corpus.truth_labels()
+    truth = corpus.truth_labels(level=truth_level)
     pred = predict(corpus)
     metrics = score(truth, pred)