Add Holehe collector for email targets

Closes the email target-type gap (previously had zero collectors).
Checks whether an email is registered on 120+ sites via the
password-reset-oracle technique. Shares the Sherlock/whois venv.

HoleheRunner gates success on the CSV file existing rather than the
process exit code: holehe's CLI calls Python's exit("message") right
after writing results on its normal success path, which always yields
exit code 1 regardless of outcome — discovered while verifying this
end-to-end against the real dev server and queue worker.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

PLAN.md

@@ -51,9 +51,9 @@ commands).
 - **Targets** — the entity being investigated (person, domain, email,
   username, IP, org), scoped to one investigation
 - **Sources** — catalog of OSINT tools/techniques (seeded: Sherlock,
-  theHarvester, crt.sh, WHOIS, ip-api.com — all 5 now have a working
-  runner). `sources.runner` is a display-only label; the real mapping
-  is `App\Osint\RunnerRegistry`
+  theHarvester, crt.sh, WHOIS, ip-api.com, Holehe — all 6 now have a
+  working runner). `sources.runner` is a display-only label; the real
+  mapping is `App\Osint\RunnerRegistry`
 - **Findings** — result of running a source against a target; raw JSON
   payload preserved plus a parsed summary
 
@@ -210,6 +210,24 @@ commands).
      resolve sequentially through the single worker, hit and diagnosed
      the crt.sh flakiness live, confirmed a retried lookup completing
      cleanly. All test data cleaned up afterward.
+10. **Holehe collector** (done) — 6th source, closes the `email`
+    target-type gap (previously zero collectors for it). Checks
+    whether an email is registered on 120+ sites via the
+    password-reset-oracle technique; same venv as Sherlock/whois
+    (`scripts/python/setup.sh` updated). `HoleheRunner` follows the
+    Sherlock/CSV pattern but with one wrinkle discovered while
+    verifying it end-to-end: holehe's CLI calls Python's
+    `exit("message")` on its normal success path right after writing
+    the CSV (`core.py: export_csv`), which always yields exit code 1 —
+    a real successful run and a genuine crash are indistinguishable by
+    exit code alone. Fixed by gating on whether the CSV file actually
+    exists instead of `successful()`. Courtesy rate limit: 15/min
+    (`osint-runner:holehe`). Not unit-tested (real process + network,
+    same as Sherlock/whois/theHarvester); verified by hand instead:
+    registered a user, added an `email` target, ran Holehe through the
+    live systemd worker, watched it fail with the exit-code-1 quirk
+    before the fix and complete cleanly after, confirmed the summary
+    rendered correctly in the UI. Test data cleaned up afterward.
 
 ## Open questions
 - Any legal/ToS constraints on the sources to be queried?