docs: settle the vendor and MISP destinations

The report spec names three destination kinds and the module writes only
one. Verified through the public API: generate() on a manifest with an IP
contact returns a single email row, and nothing in the tree mentions a misp
or api row. The plan the module was built from never carried that task, so
report is complete against its plan and incomplete against its spec. Found
when the submit brainstorm began, since submit is specified to fill bodies
into rows that do not exist.

The addendum settles which rows exist: configured AND holding an indicator
the destination accepts, each row carrying only the types it can act on.
The accepted types were read from each vendor's own documentation rather
than from memory, which is the provider table's lesson. That reading is
also what removed VirusTotal: its only submission endpoints are POST /urls
and file upload, so it accepts exactly what URLhaus accepts and nothing
else, and it takes no verdict with a submission. It goes to backlog item 6
with the findings, including the reason its more interesting read side
collides with the fourth property.

Also records that generate() rebuilds destinations wholesale, which is safe
only while the freeze rule holds, and names that as a constraint on the
submit spec rather than a description of this one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0176FYdVfpzUq8S9jecqQqL6

0 files changed, 0 insertions, 0 deletions