feat(09-01): add Engine with parallel fanout and ExampleSource

- Engine.Register/List/SweepAll with ants pool fanout
- ExampleSource emits two deterministic findings (SourceType=recon:example)
- Tests cover Register/List idempotency, SweepAll aggregation, empty-registry,
  and Enabled() filtering

pkg/recon/example.go

@@ -0,0 +1,61 @@
+package recon
+
+import (
+	"context"
+	"time"
+
+	"golang.org/x/time/rate"
+)
+
+// ExampleSource is a deterministic stub ReconSource used to prove the Engine
+// fanout pipeline end-to-end. Phases 10-16 replace this with real sources
+// (Shodan, GitHub, Pastebin, ...).
+type ExampleSource struct{}
+
+// Name returns the stable identifier used for SourceType routing.
+func (ExampleSource) Name() string { return "example" }
+
+// RateLimit returns a conservative 10 req/s (only matters once wired to a
+// LimiterRegistry in plan 09-02; ExampleSource does no real network I/O).
+func (ExampleSource) RateLimit() rate.Limit { return rate.Limit(10) }
+
+// Burst returns the token bucket burst size.
+func (ExampleSource) Burst() int { return 1 }
+
+// RespectsRobots reports false: this stub performs no HTTP fetches.
+func (ExampleSource) RespectsRobots() bool { return false }
+
+// Enabled always returns true so the stub participates in SweepAll by default.
+func (ExampleSource) Enabled(_ Config) bool { return true }
+
+// Sweep emits two deterministic fake Findings tagged with SourceType
+// "recon:example". The query argument is intentionally ignored.
+func (ExampleSource) Sweep(ctx context.Context, _ string, out chan<- Finding) error {
+	now := time.Now()
+	fakes := []Finding{
+		{
+			ProviderName: "openai",
+			KeyMasked:    "sk-examp...AAAA",
+			Confidence:   "low",
+			Source:       "https://example.invalid/a",
+			SourceType:   "recon:example",
+			DetectedAt:   now,
+		},
+		{
+			ProviderName: "anthropic",
+			KeyMasked:    "sk-ant-e...BBBB",
+			Confidence:   "low",
+			Source:       "https://example.invalid/b",
+			SourceType:   "recon:example",
+			DetectedAt:   now,
+		},
+	}
+	for _, f := range fakes {
+		select {
+		case out <- f:
+		case <-ctx.Done():
+			return ctx.Err()
+		}
+	}
+	return nil
+}