refactor: credit ares techniques from token_coverage instead of redis

[l50]

Key Changes:

• Replaced the second Redis round-trip (SDIFF exploited superseded) with ares's own token_coverage map, so technique credit is derived from a single loot payload
• Eliminated the hand-maintained vuln_id prefix table that mirrored ares's category mapping, removing a persistent source of drift between the two sides
• Ensured synthesized JSONL is byte-stable across polls by walking categories in sorted order

Added:

• aresTokenCoverage struct and TokenCoverage field to model ares's token_coverage JSON, keyed by scoreboard category with proven-only Exploited counts - transport_ares.go
• aresCategoryToTechniqueID to handle the small residual translation between ares category keys and answer-key technique IDs, explicitly refusing check-only categories (zerologon), the catch-all (other), and the per-domain golden_ticket (credited via domain_compromise[] instead)
• writeTokenCoverageEntries to credit one technique per category with a proven exploit, respecting the shared emitted map and sorted iteration
• Comprehensive test coverage for the new path including exploited-only crediting, deterministic ordering, nil-coverage safety, shared-emitted dedup, and per-domain golden-ticket handling - transport_ares_test.go

Changed:

• FetchReport now includes token_coverage in its jq filter and no longer performs a second SSM/Redis call for exploited techniques - transport_ares.go
• synthesizeJSONL signature dropped its exploited []string parameter, with all call sites updated across transport_ares.go and verify_test.go
• Rewrote TestAresExploitedToTechniqueIDs into TestAresCategoryToTechniqueID and updated the answer-key existence guard to enumerate ares category keys rather than raw vuln_id shapes - transport_ares_test.go

Removed:

• fetchExploited and its ares:op:<id>:exploited/:superseded Redis SDIFF logic, now superseded by ares's own proven-only counting - transport_ares.go
• aresExploitedToTechniqueIDs prefix-matching table and its reflect-based test, both obsoleted by ares normalising categories to scoreboard names upstream - transport_ares.go, transport_ares_test.go

[l50]

Closing as a duplicate of #28, which implements the same token_coverage adoption and handles it better.

I checked both of the cases I was going to raise and #28 already covers them: the forest_trust → cross_forest_trust rename is in its category table, and zerologon and golden_ticket are both in its uncreditable set.

It also gets one case right that this PR got wrong: #28 refuses printnightmare because ares mints that id from banner text rather than a confirmed exploit, whereas this PR passed it through as creditable and would have produced a false credit.