feat(catalog): add Wiza people and company enrichment

[shehjad-dev]

Adds Wiza (wiza) as a Bearer-key enrichment provider. It catalogs the full official API surface, enables bounded synchronous calls on treg's platform key, and keeps account-scoped asynchronous jobs on BYOK.

Why now: Wiza adds structured people and company search, company enrichment, contact reveals, and bulk-list workflows. The synchronous search and company-enrichment calls fit treg's existing capability and settlement contracts. The asynchronous calls do not yet have safe shared-account ownership and terminal settlement, so this PR exposes them only to teams that connect their own Wiza key.

Listing owner / contact: @shehjad-dev (platform-key custodian for this integration). No external vendor contact is recorded.

What's in the diff

• oauth_providers.py and config.py — Wiza registry entry, Bearer injection, free GET /api/meta/credits connection probe, and an unset TREG_PLATFORM_KEY_WIZA setting.
• catalog/wiza.yaml — 12 caller-facing tools that cover 12 official paths. The thirteenth path, the credit balance route, stays internal to connection checks and capacity collection.
• catalog/adapters.yaml — verified adapters for one-row people search, one-row company search, and company enrichment. They join the existing routing and Enrich Arena machinery without Wiza-specific runtime code.
• catalog/fx.yaml — $0.025 per API credit, based on Wiza's public one-time, non-expiring credit purchase rate. The promotional grant is excluded from the replacement-rate calculation. No later custom rate is claimed.
• Capacity — a finite, nonnegative credits.api_credits collector and credits / manual / api policy. A provisional provider-wide 30-per-minute shared-key spacer reuses Wiza's documented company-enrichment ceiling because search and autocomplete limits are unpublished and smoothing is not endpoint-aware. Sequential platform calls are spaced about two seconds apart; 20 one-row pages add about 38 seconds of waiting. BYOK bypasses the limiter. Its bounded, process-local wait reduces ordinary bursts but is not a strict quota gate. Vendor auto-top-up is not enabled, and no overflow route is added.
• Five sanitized fixtures, the supplied Wiza logo asset, focused provider tests, and a Wiza context fragment. No application call, money, relay, route, or Arena branch is provider-specific.

Endpoint and price ledger

Tool / internal route	Method and path	Platform	Catalog price / evidence
wiza.people.search	POST /api/prospects/search	yes, fixed at one row	0.5 credit for a non-empty one-row page; live observed
wiza.companies.search	POST /api/accounts/search	yes, fixed at one row	0.5 credit for a non-empty one-row page; two pages live observed
wiza.companies.enrich	POST /api/company_enrichments	yes	2 credits on a hit; live observed; miss and invalid input were free
wiza.meta.locations.search	GET /api/meta/location_autocomplete	yes	free; live observed
wiza.meta.technologies.search	GET /api/meta/technology_autocomplete	yes	free; live observed
wiza.people.reveal.start	POST /api/individual_reveals	BYOK only	exact terminal result: profile 1, valid email 2, phone 5, full up to 7; live observed
wiza.people.reveal.get	GET /api/individual_reveals/{id}	BYOK only	polling itself was free in live checks
wiza.lists.create	POST /api/lists	BYOK only	up to 7 credits per successful item by selected enrichment; documented
wiza.lists.get	GET /api/lists/{id}	BYOK only	unknown for a completed list; a missing-list check was free
wiza.lists.contacts	GET /api/lists/{id}/contacts	BYOK only	unknown; no separate published charge and no paid list was created
wiza.prospect-lists.create	POST /api/prospects/create_prospect_list	BYOK only	unknown; synchronous search pricing is not copied into the async route
wiza.prospect-lists.continue	POST /api/prospects/continue_search	BYOK only	unknown; no published terminal per-row price
internal credit probe	GET /api/meta/credits	not a catalog tool	free; live observed

The seven BYOK-only tools use account-scoped result IDs and can finish after the initiating HTTP call. The IDs carry no caller ownership token. Shared platform access would require a durable owner link and terminal-charge settlement, so this PR does not guess at that design.

Verification evidence

All live checks used the assigned Wiza key without printing or storing it in the repository. Public or synthetic targets were used, and raw responses stayed outside the repository.

Check	Result	Credit delta
Bogus key against credit probe	upstream 401; local connection returned 422	0
Assigned key against credit probe	upstream 200; local connection returned 200	0
Company enrichment, invalid input	400	0
Company enrichment, synthetic miss	404	0
Company enrichment, public company	200; response reported 2	2
Company search, first and second one-row pages	200; next token followed	0.5 each
Prospect search, one-row page	200	0.5
Location and technology helpers	200	0 each
Reveal: profile / email / phone / full	terminal success	1 / 2 / 5 / 7
Reveal, synthetic miss	terminal failure	0

Total live discovery and dataplane spend was 22.5 Wiza credits, below the 100-credit ceiling.

Local platform settlement: company hit → Wiza reported 2 credits, treg reserved and settled 50,000 micro-USD at the public replacement rate. Invalid input and a synthetic miss released their holds and settled zero. The ledger showed one close entry for every reserve.

BYOK precedence: after connecting a team Wiza key, the same company hit used that key, returned no treg cost header, and did not change the team balance. The team's key won over the platform key.

Routing and Arena

• People search accepts a structured title and returns the provider total and next token.
• Company search accepts industry or technology and returns the provider total and next token.
• Company enrichment accepts a domain or name.
• Platform search calls are fixed at one row, so the pre-request hold is exact and pagination remains available one row at a time. Under the provisional shared-key policy, sequential platform pages are spaced about two seconds apart; BYOK is unaffected.
• Async reveal and bulk-list tools do not enter routes or Arena because they cannot return and settle one owned result inside the same call lifecycle.

Validation

• catalog_validate.py: OK — 103 provider files, 3,356 endpoints, 0 errors, 0 warnings
• Wiza tests: 21 passed
• Central capacity and routing suites: 171 passed
• Post-rebase focused checks: 22 passed
• Import contracts: 14 kept, 0 broken
• Context drift: every changed source maps to reviewed fragments
• Generated skill mirror check: all five mirrors match
• Full isolated parallel suite: 4,191 passed, 8 skipped, 2 unrelated archive failures
• Exact rerun of both archive failures: 2 passed

The earlier required CI failure was test_the_plugin_skill_is_not_stale: adding Wiza raised the provider count rendered from the {PROVIDERS} placeholder in src/treg/web/skill.md from 76 to 77, which made all five generated skill mirrors stale. Commit 3bc238ed regenerates those mirrors in this PR; build_plugin.py --check now passes. This was caused by the Wiza change, not inherited from main.

The two failures in the post-rebase full local run were archive timing/SQLite-lock flakes outside the Wiza diff: test_upload_timeout_retries_once_and_recovers and test_change_observation_failure_preserves_record[missing]. Both passed immediately when rerun alone against a fresh isolated database.

Operations and production state

• Not enabled in production by this PR. This PR does not set a key, edit private deployment configuration, merge, buy credits, or enable auto-top-up.
• After merge, the owner plans to enable platform-provided Wiza access separately by setting TREG_PLATFORM_KEY_WIZA in the private deployment configuration and adding wiza to TREG_PLATFORM_PROVIDERS.
• Keep Wiza vendor auto-top-up off unless a separate approved change enables it.
• Capacity can report remaining API credits, but exhaustion behavior is not claimed because the funded balance was not deliberately exhausted. There is no overflow route.

Known gaps

• Search and autocomplete rate limits are not published. The provider-wide 30-per-minute policy is provisional; relax it with real 429 evidence or replace it when smoothing becomes endpoint-aware.
• Successful completed-list download pricing and async prospect-list terminal pricing remain unknown and are labeled as such.
• Shared-platform async ownership and terminal settlement are not implemented.
• A later custom commercial credit rate has not been agreed and must not be inferred from this PR.