AIML-1463 Remove false lastSeen signal from list_applications_by_cve

[ChrisEdwards]

AIML-1463

Why the change

list_applications_by_cve told agents that every affected app "has never been observed running" because TeamServer's CVE endpoint always sends last_seen: 0 (TS-42938), and our code read that zero as a meaningful signal.

Special things to note

• Breaking change to published artifact. App.lastSeen is removed from contrast-mcp-core. The aiml-services bump is tracked in child bead mcp-074d9 (same Jira).
• Re-adding lastSeen later. When TS-42938 ships with real data, lastSeen comes back as a nullable field (tracked in bead mcp-ra7w).
• Code owners switch. .github/CODEOWNERS now names @Contrast-Security-OSS/platform-developers in place of @Contrast-Security-OSS/aiml-developers. @ChrisEdwards stays.

Change outline

The false signal flowed through three pieces. All three are removed:

 App.java (data model)
   appId
   name
   firstSeen        # ← has real values, kept
-  lastSeen         # ← always 0 from this endpoint, removed
   lastReset
   servers

 ListApplicationsByCveTool.java
   @Tool description:
-    "lastSeen and server status reflect last-known agent reports..."
+    "Use search_applications for application lastSeenAt and
+     search_servers for current server state."

   listApplicationsByCve():
     fetchCveData()
     if (apps empty) return
-    noticeNeverObservedApps(apps)    # ← always fired, always wrong
     enrichWithClassUsage(apps)
     return

-  noticeNeverObservedApps(apps):     # ← deleted entirely
-    filter apps where lastSeen == 0
-    emit "never been observed running: <app names>"

Three test layers now enforce the removal:

 Unit test    (ToolTest)       → deserializes {last_seen: 0}, asserts field absent from JSON output
 Parity test  (LocalParity)   → same assertions through the local stdio code path
 Integration  (ToolIT)        → same assertions against live TeamServer response