over-engineering audit: remove dead code, speculative config, duplicate queues

- delete embedded community resolver snapshot (6,760 lines) + EmbeddedServers +
  DNS_SERVERS=fresh; curated resolvers are the default. Simplify Warm (no
  sampling).
- one generic internal/sample.Queue[T] replaces three near-identical
  random-sample queues (probe, pipeline, discover).
- delete unreachable index.listOpenSearch (OpenSearch is never listable).
- delete classifyCloudFront (its match is always discarded, !ResourceSpecific).
- delete probe.Probe wrapper + Describe; tests use ProbeDetailed.
- delete store.Pool(), model.SourceDNSAlias, discover.QueueLen.
- drop dead config/no-op knobs: pipeline DirectWorkers, discover MaxPerDomain,
  discover S3/GCS/DO flags, BUCKET_SCAN_DO.
~-7,000 lines (mostly the resolver snapshot), 0 deps removed, tests green.

internal/classify/aws.go

@@ -17,25 +17,6 @@ func aws(p model.Provider, s model.Service, sem model.PublicSemantic, resource,
 	}
 }
 
-// classifyCloudFront matches <distribution>.cloudfront.net. Custom domains
-// almost always CNAME to a CloudFront distribution, so this is how CDN-hosted
-// static sites get discovered via DNS enrichment.
-func classifyCloudFront(s *scanner) (model.Match, bool) {
-	n := s.n
-	if n != 3 || s.label(n-1) != "net" || s.label(n-2) != "cloudfront" {
-		return model.Match{}, false
-	}
-	// CloudFront distributions are CDN endpoints, not buckets or databases, so
-	// they are identified but not stored as findings.
-	return model.Match{
-		Provider:         model.ProviderAWS,
-		Service:          model.ServiceWebApp,
-		ResourceSpecific: false,
-		PublicSemantic:   model.PublicSemanticPublicEndpoint,
-		Resource:         s.label(0),
-	}, true
-}
-
 func classifyAWS(s *scanner) (model.Match, bool) {
 	n := s.n
 	if n < 4 || s.label(n-1) != "com" || s.label(n-2) != "amazonaws" {