feat(cve-json): classify .ai service handles as tool credits

tools/cve-tool-vulnogram/bot-credits-policy.md

@@ -88,6 +88,9 @@ A handle or email is *obvious bot/AI* when **any** of these match:
    these case-insensitive regex patterns:
    * `*-bot`, `*bot` (e.g. `securitybot`, `release-bot`)
    * `*-ai`, `*ai` (e.g. `scan-ai`, `securityai`)
+   * `*.ai` — domain-style AI-service handles (e.g. `bugbunny.ai`,
+     `xbow.ai`); an AI bug-hunting service credited by its `.ai`
+     product handle is a tool, not a human finder
    * `*-agent`, `*agent` (e.g. `triage-agent`)
    * `*-gpt`, `*gpt` (e.g. `secaudit-gpt`)
    * `*scanner*`, `*-scan` (e.g. `securityscanner-7`, `audit-scan`)

tools/cve-tool-vulnogram/generate-cve-json/src/generate_cve_json/cve_json.py

@@ -350,6 +350,7 @@ def _populate_constants() -> None:
     re.compile(r"\b[\w]*-bot\b", re.IGNORECASE),
     re.compile(r"\b[\w]+bot\b", re.IGNORECASE),
     re.compile(r"\b[\w]*-ai\b", re.IGNORECASE),
+    re.compile(r"\b[\w-]+\.ai\b", re.IGNORECASE),
     re.compile(r"\b[\w]*-agent\b", re.IGNORECASE),
     re.compile(r"\b[\w]*-gpt\b", re.IGNORECASE),
     re.compile(r"\b[\w]*scanner[\w]*\b", re.IGNORECASE),

tools/cve-tool-vulnogram/generate-cve-json/tests/test_generate_cve_json.py

@@ -194,6 +194,8 @@ def test_known_name_matches_inside_free_form_string(self, name: str):
             "release-bot",
             "securitybot",
             "scan-ai",
+            "bugbunny.ai",  # domain-style AI-service handle
+            "xbow.ai",
             "triage-agent",
             "secaudit-gpt",
             "securityscanner-7",