Detection: two-step resolution seam (isOutbound -> resolveProvider), emit unknown outbound instead of dropping, enrich capture

[AndresL230]

Part of #142.

Summary

Today a call that's clearly outbound but unattributed is silently discarded at two points: detection (src/scanner/core-scanner.ts:269 — if (!fp && !knownSdkProvider && !knownHttpHost) continue;) and endpoint aggregation (src/scan-results.ts isHighConfidenceEndpointUrl rejecting sdk:// placeholders — see #141). This makes "unknown provider" and "not a call" indistinguishable. Per the agreed design, an outbound-but-unknown call should become a logged known-unknown with a captured "calling card" so providers can be backfilled.

Proposed fix

• Split resolution into two explicit steps:
  • isOutbound(call) — from call shape: bound HTTP-client method, bound SDK/agent method, fetch/axios/requests/httpx, etc. (no provider needed).
  • resolveProvider(call) — best-effort attribution (existing logic + #A/#B/#C).
• When isOutbound && !provider: emit a match with provider: "unknown", kind: "http" | "sdk", and a capture payload: { hostFragment?, sdkRoot?, modelString?, methodChain, file, line }. Do not drop.
• Relax both gates to accept isOutbound matches: core-scanner.ts:269, and teach isHighConfidenceEndpointUrl to accept sdk:// / unknown:// shapes (coordinate with Endpoint aggregation drops cross-file-resolved SDK calls with sdk:// placeholder URLs (A5 cross-file factory invisible to benchmark) #141 so cross-file sdk:// calls also survive aggregation).
• Aggregate captures into the end-of-scan scanNotification (today a bare unknown count, see CLI remote submit omits per-call provider, API rejects whole batch → silent local-only fallback #136 / wave 6) → a ranked, deduped list of "providers seen but not fingerprinted" for backfill.

Acceptance criteria

• An outbound call with an unresolvable host is emitted as provider:"unknown" with a non-empty capture, not dropped.
• sdk:// / unknown:// calls survive endpoint aggregation (coordinated with Endpoint aggregation drops cross-file-resolved SDK calls with sdk:// placeholder URLs (A5 cross-file factory invisible to benchmark) #141).
• Scan output includes an aggregated, deduped list of unknown captures (host fragment / SDK root / model string).

Related: #141, #136.