fix: classify explicit Massive provider errors as provider_negative - #64

Summary

• _semantic_reason in the SEC live E2E now detects an explicit top-level
  error_message / error / message envelope and classifies it as a
  provider-side attribution (rate_limited, network_or_timeout,
  provider_validation_error, or provider_runtime_error).
• Probe key whitelist extended with SEC row fields (cik, filing_date,
  filing_type, primary/secondary/tertiary_category, supporting_text) so
  value-free probes reveal row structure.

Why

Live Massive connector intermittently returns
{"error_message": ..., "result": {"data": "<string>"}} instead of the wrapped
success envelope. The old extractor mapped that to
unexpected_response_shape, which the attribution gate correctly refuses to
publish as provider_negative, leaving every affected live SEC cell failing CI.

Validation

• uv run pytest -q: 395 passed, 9 skipped
• uv run ruff check + ruff format --check: clean
• uv run mypy src: no issues
• New unit tests cover reason classification, explicit-error mapping, and the
  wrapped-success path.