over-engineering audit: remove dead code, speculative config, duplicate queues

- delete embedded community resolver snapshot (6,760 lines) + EmbeddedServers +
  DNS_SERVERS=fresh; curated resolvers are the default. Simplify Warm (no
  sampling).
- one generic internal/sample.Queue[T] replaces three near-identical
  random-sample queues (probe, pipeline, discover).
- delete unreachable index.listOpenSearch (OpenSearch is never listable).
- delete classifyCloudFront (its match is always discarded, !ResourceSpecific).
- delete probe.Probe wrapper + Describe; tests use ProbeDetailed.
- delete store.Pool(), model.SourceDNSAlias, discover.QueueLen.
- drop dead config/no-op knobs: pipeline DirectWorkers, discover MaxPerDomain,
  discover S3/GCS/DO flags, BUCKET_SCAN_DO.
~-7,000 lines (mostly the resolver snapshot), 0 deps removed, tests green.

internal/probe/probe_test.go

@@ -38,11 +38,11 @@ func TestProbeStorageStatuses(t *testing.T) {
 	for _, tc := range cases {
 		p := New(Config{Workers: 1, Timeout: time.Second})
 		host := serverHost(t, statusHandler(tc.status))
-		got, detail := p.Probe(context.Background(), model.Candidate{
+		r := p.ProbeDetailed(context.Background(), model.Candidate{
 			Hostname: host, Provider: model.ProviderAWS, Service: model.ServiceS3,
 		})
-		if got != tc.want {
-			t.Errorf("status %d: got %s (%s), want %s", tc.status, got, detail, tc.want)
+		if r.Exposure != tc.want {
+			t.Errorf("status %d: got %s (%s), want %s", tc.status, r.Exposure, r.Detail, tc.want)
 		}
 	}
 }
@@ -54,29 +54,29 @@ func TestProbeS3RegionRedirect(t *testing.T) {
 	})
 	p := New(Config{Workers: 1, Timeout: time.Second})
 	host := serverHost(t, h)
-	got, detail := p.Probe(context.Background(), model.Candidate{
+	r := p.ProbeDetailed(context.Background(), model.Candidate{
 		Hostname: host, Provider: model.ProviderAWS, Service: model.ServiceS3,
 	})
-	if got != model.ExposureReachable || !strings.Contains(detail, "eu-central-1") {
-		t.Fatalf("got %s (%s), want reachable with region", got, detail)
+	if r.Exposure != model.ExposureReachable || !strings.Contains(r.Detail, "eu-central-1") {
+		t.Fatalf("got %s (%s), want reachable with region", r.Exposure, r.Detail)
 	}
 }
 
 func TestProbeFirebase(t *testing.T) {
 	p := New(Config{Workers: 1, Timeout: time.Second})
 	host := serverHost(t, statusHandler(http.StatusUnauthorized))
-	got, _ := p.Probe(context.Background(), model.Candidate{
+	r := p.ProbeDetailed(context.Background(), model.Candidate{
 		Hostname: host, Provider: model.ProviderGCP, Service: model.ServiceFirebaseDB,
 	})
-	if got != model.ExposureAuthRequired {
-		t.Fatalf("got %s, want auth_required", got)
+	if r.Exposure != model.ExposureAuthRequired {
+		t.Fatalf("got %s, want auth_required", r.Exposure)
 	}
 	host2 := serverHost(t, statusHandler(http.StatusOK))
-	got, _ = p.Probe(context.Background(), model.Candidate{
+	r = p.ProbeDetailed(context.Background(), model.Candidate{
 		Hostname: host2, Provider: model.ProviderGCP, Service: model.ServiceFirebaseDB,
 	})
-	if got != model.ExposurePublicRead {
-		t.Fatalf("got %s, want public_read", got)
+	if r.Exposure != model.ExposurePublicRead {
+		t.Fatalf("got %s, want public_read", r.Exposure)
 	}
 }
 
@@ -90,11 +90,11 @@ func TestProbeAzureContainerDiscovery(t *testing.T) {
 	})
 	p := New(Config{Workers: 1, Timeout: time.Second})
 	host := serverHost(t, h)
-	state, detail := p.Probe(context.Background(), model.Candidate{
+	r := p.ProbeDetailed(context.Background(), model.Candidate{
 		Hostname: host, Resource: "acct", Provider: model.ProviderAzure, Service: model.ServiceBlobStorage,
 	})
-	if state != model.ExposurePublicRead || !strings.Contains(detail, "images") {
-		t.Fatalf("got %s (%s), want public_read via container 'images'", state, detail)
+	if r.Exposure != model.ExposurePublicRead || !strings.Contains(r.Detail, "images") {
+		t.Fatalf("got %s (%s), want public_read via container 'images'", r.Exposure, r.Detail)
 	}
 }