Indicator buckets

Per-category exports: one ZIP per indicator (email, credit_card, …) containing a TSV with provenance + a deduplicated wordlist. Subsequent builds default to incremental — they only process JSONL files that didn't exist when the parent bucket ran and reuse the parent's distinct values to dedup.