feat(cve-json): classify .ai service handles as tool credits

[potiuk]

Summary

• Bot-credit detection in generate-cve-json matched hyphenated -ai / -agent / -gpt handles but not domain-style AI-service handles like bugbunny.ai, so an AI bug-hunting service credited by its .ai product handle landed as type: finder instead of type: tool in the CVE record's credits[].
• Add a \b[\w-]+\.ai\b pattern to BOT_CREDIT_PATTERNS, a matching bullet to bot-credits-policy.md, and two test cases (bugbunny.ai, xbow.ai).

Motivation

Surfaced while crediting an AI bug-hunting service (a .ai product handle) on an advisory: it's an automated discovery service, so CVE 5.x type: "tool" is the accurate row — but the .ai domain form slipped past the existing hyphen-suffix patterns and there's no manual override hook (the field is the single source of truth; the generator decides finder-vs-tool). Adding the .ai form closes that gap.

Test plan

• pytest tools/cve-tool-vulnogram/generate-cve-json — green; test_pattern_handles_match now covers bugbunny.ai / xbow.ai, test_human_names_do_not_match still green (the \b…\.ai\b anchor doesn't fire on free-standing "AI" or human names).
• prek run --files … — ruff, mypy, markdownlint, typos, pytest all pass.