A/AAAA & wildcard takeover + private-IP hygiene assessor

[danielmichaels]

Part of #61 · Tier 4 · takeover · Effort: M

Extend the takeover/hygiene surface beyond CNAME to A/AAAA targets and wildcard behaviour.

Checks

• A/AAAA cloud-IP takeover: A/AAAA pointing to deprovisioned/claimable cloud IP ranges (extend the cname_fingerprints.go provider catalogue to IP-range matching for the major clouds).
• Wildcard DNS detection: explicitly called out in ARCHITECTURE.md (CNAME section, Assess Phase). Query a random non-existent label under the domain; if it resolves, the zone uses a wildcard — record it (affects takeover/false-positive logic and is a finding in its own right).
• Private/reserved IP in public DNS: A/AAAA → RFC1918 / loopback / link-local / ULA published in public DNS = info leak + DNS-rebinding surface.

Cost flag

Active: one extra resolution (random label) for wildcard detection; cheap. Rate-limit as usual.

Storage

Reuse dangling_cname_findings family or extend with new issue_types; decide in review.

Wiring (per #61 recipe)

• AssessIPTargetsArgs + worker; register; enqueue from ResolveDomainWorker
• (a *Assessor) AssessIPTargets
• sqlc + task sqlc; observer entity; UNION/service/UI surfacing
• TDD tests

Decisions for owner

• Severity for private-IP-in-public-DNS (info vs low).
• Source/maintenance of cloud IP-range data.