research(provider): cloud runtime state as a table-keyed json document

Most cloud-compliance policies (CIS, PCI and framework packs) read live cloud state, not a file.
The Tirith side is small: an envelope convention ({"snapshot_version": …, "aws_s3_bucket": [row, …]}) read through the json provider with absence-padding — not a new provider package.
The collector question has a better answer than "build one": AWS Config configuration snapshots,
Azure Resource Graph and GCP Cloud Asset Inventory each emit a keyed JSON inventory inside the
customer's account — Tirith reads a file and never holds a cloud credential, so the project becomes
"read three export formats". An existing multi-cloud inventory tool remains the right general-purpose collector. Open needs:
a redactor (live API rows hold credential reports and key policies), staleness that fails closed,
and the nothing-in-scope decision ("no rows of that table" is the modal case).

Start with the existing JSON provider and trace how table-keyed documents and absence-padding are handled. Compare AWS Config, Azure Resource Graph, and GCP Cloud Asset Inventory export shapes, then resolve the redaction, fail-closed staleness, and no-rows behavior described in the issue. Done means the supported export formats and those edge cases have clear, tested behavior.