[Phantom9869]

Fixes from a full-repo review of the merged pipeline.

Important

• Takeover now runs per discovered host, not apex-only — the README's dangling-CNAME-on-a-subdomain example could never fire before.
• Liveness pre-flight gates only the web-fetch modules (fingerprint/headers/TLS/CORS/methods/exposed-files); takeover and ports always run, since dangling CNAMEs and open DB ports live on hosts with no answering web port. A dead host now costs seconds, not stacked 10s timeouts.
• HTTPS -> HTTP fallback in gambit.http (get_for_host/options_for_host) with a per-host scheme cache, so HTTP-only sites get real checks instead of five 'could not fetch' INFOs.
• Connectivity failures deduped to one INFO per host in pipeline.run_for_host.
• crt.sh queried once per host per scan (per-process cache in gather).

Smaller

• Shared http.options helper (http_methods no longer bypasses plumbing); TLS uses public unverified-context API instead of ssl._create_unverified_context.
• Consistent host/port parsing (pipeline.split_host_port) for ports and TLS.
• CORS wildcard+credentials downgraded HIGH -> MED (browsers reject that combo; reflected+credentials stays HIGH).
• exposed_files sleeps only between checks, not after the last.
• README example output now matches real output; roadmap tests box ticked.

Verification

• 134 tests pass (14 new/updated: test_http, test_cli, preflight + connectivity-dedupe + split_host_port in test_pipeline, crt.sh cache in test_gather, CORS severity).
• Localhost smoke test: plain-HTTP server on 127.0.0.1:8000 now yields real header/fingerprint/port findings in a Markdown report. No external target scanned.