Resolve a company's domain

The insight: a wrong domain poisons every row downstream — refusing beats guessing. The naive version takes the first search hit or whatever a lookup returns; the failure is silent, and every enrichment, signal, and email built on it inherits the wrong company. So this skill treats any looked-up domain as a CANDIDATE, validates it actually belongs to the operating company (not a parent, a brand redirect, or a similarly-named stranger), and returns ambiguous or not_found — with candidates — when the name doesn't pin one entity. An honest refusal costs a re-ask; a confident wrong domain costs the whole row, invisibly.

Declared inputs

Nothing here ships with a value. Each one is the installer's, not the author's: ask for it, never substitute a plausible default, and where an answer does not exist say which step becomes unavailable rather than guessing. Where a default IS defensible it is named below, and using it means saying so in the output.