Add Holehe collector for email targets

Closes the email target-type gap (previously had zero collectors).
Checks whether an email is registered on 120+ sites via the
password-reset-oracle technique. Shares the Sherlock/whois venv.

HoleheRunner gates success on the CSV file existing rather than the
process exit code: holehe's CLI calls Python's exit("message") right
after writing results on its normal success path, which always yields
exit code 1 regardless of outcome — discovered while verifying this
end-to-end against the real dev server and queue worker.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/python/setup.sh

@@ -3,10 +3,10 @@
 set -euo pipefail
 cd "$(dirname "${BASH_SOURCE[0]}")"
 
-# Sherlock + python-whois share one lightweight venv.
+# Sherlock, python-whois, and Holehe share one lightweight venv.
 python3 -m venv .venv
 .venv/bin/pip install --upgrade pip -q
-.venv/bin/pip install sherlock-project python-whois -q
+.venv/bin/pip install sherlock-project python-whois holehe -q
 
 # theHarvester (>=4.7 needs Python 3.12; pinned to 4.6.0 for 3.9+ compat)
 # pulls in a much heavier dependency set (playwright, censys, shodan, fastapi),