Reconcile time-valid threat-intelligence leads

Repair hunt.sql. Return exactly event_id, host_id, normalized_domain, observed_second, matched_indicators, one row per qualifying event, with no imported duplicates. At observation second 1000, consider only connected, outbound observations in inclusive seconds 700..1000. Failed or inbound events remain excluded. Normalize event, indicator and suppression domains by lowercase and removal of trailing dots; require exact equality, never suffix, substring or subdomain matches. All supplied domains are nonempty ASCII DNS names. For each eligible event, count DISTINCT indicator_id values with the same normalized domain, revoked=0 and confidence>=80. Unknown NULL confidence is insufficient. The event must be at/after valid_from and strictly before valid_until; NULL valid_until has no upper bound. Use the event's observed time, not the report time. Return only events with at least one qualifying indicator. Multiple valid indicators form one event lead with its actual count. Suppress an event only if an authorized=1 record matches BOTH its host and exact normalized domain, with start_second<=observed<end_second. Another host's permission, a future or expired permission, or an unauthorized record cannot suppress it. Preserve actual source event and host identities and the normalized domain/time. Imported copies must not multiply indicator counts or event rows. A grouped temporal join or correlated evidence count is valid. Inspect expiry, normalization and host-specific authorization witnesses, and repair without Reset. A lead is not a compromise verdict.