bucket discovery: no name guessing

Remove all fabricated candidate names (suffixes and the wordlist). Discovery now
only tests names that actually occur in the incoming hostname: the subdomain
label and the registrable-domain label (assets.example.com -> assets, example).
Nothing is permuted or drawn from a wordlist.

internal/discover/discover_test.go

@@ -5,16 +5,10 @@ import (
 	"testing"
 )
 
-func TestCandidates(t *testing.T) {
+func TestCandidatesAreExactLabelsOnly(t *testing.T) {
 	got := candidates("assets.example.com", 200)
-	set := map[string]bool{}
-	for _, c := range got {
-		set[c] = true
-	}
-	for _, want := range []string{"example", "example-assets", "example-backups", "example-static"} {
-		if !set[want] {
-			t.Fatalf("candidates missing %q (got %v)", want, got)
-		}
+	if len(got) != 2 || got[0] != "assets" || got[1] != "example" {
+		t.Fatalf("candidates = %v, want [assets example] (no fabricated names)", got)
 	}
 	for _, c := range got {
 		if !validBucketName(c) {
@@ -24,7 +18,6 @@ func TestCandidates(t *testing.T) {
 }
 
 func TestBaseLabelsSkipsNoise(t *testing.T) {
-	// www is skipped, so only the registrable label remains.
 	got := baseLabels("www.example.com")
 	if len(got) != 1 || got[0] != "example" {
 		t.Fatalf("baseLabels = %v, want [example]", got)
@@ -57,7 +50,7 @@ func TestTargets(t *testing.T) {
 }
 
 func TestMaxPerDomain(t *testing.T) {
-	if got := candidates("example.com", 5); len(got) != 5 {
+	if got := candidates("example.com", 5); len(got) > 5 {
 		t.Fatalf("MaxPerDomain not honored: got %d", len(got))
 	}
 }