docs: reconcile COMMANDS/FEEDS with the tree; document the test suite

[spierenburg]

What this PR brings

Reconciles docs/COMMANDS.md and docs/FEEDS.md against what is actually in the tree, and documents how to run the test suite.

Eight modules exist but are undocumented, so nobody browsing the docs knows they are there. One documented command does not exist.

Commands added to docs/COMMANDS.md (5)

row	module
Kaspersky OpenTIP	commands/kaspersky/
Pulsedive	commands/pulsedive/
Validin	commands/validin/
Watch	commands/watch/
Welcome	commands/welcome/

The Kaspersky row notes that it is intentionally not bound to @ioc by default — enabling Kaspersky in a SOC tool is a compliance call the operator should make explicitly, not something that should happen implicitly via an IOC alias.

Feed sources added to docs/FEEDS.md (3)

row	module
PhishingCatcher	modules/phishingcatcher/
Ransomware Data Leak	modules/ransomleak/
VARIoT IoT Vulnerabilities	modules/variot/

Removed: phantom GeoLocation row

docs/COMMANDS.md listed GeoLocation ("Convert latitude/longitude values into an address"). There is no commands/geolocation/ in the tree. The real module is GeoLookup (commands/geolookup/), which is listed immediately below it and does the same job via OpenStreetMap Nominatim. The GeoLocation row looks like a leftover from before that rename — it sends readers looking for a command that cannot be invoked.

CONTRIBUTING.md

Adds the two commands a contributor should run before opening a PR:

python3 -m unittest discover -s tests -v
python3 feed_audit.py --check   # static load-contract check for feed modules

Both are stdlib-only — no third-party dependencies — and both already run in CI on every PR. They were simply never written down, so a first-time contributor has no way to know the suite exists.

Verification

Every row was checked against the tree on main before being added:

• all 5 command directories and all 3 feed-module directories exist
• none of the 8 appear in the current docs
• commands/geolocation/ does not exist; commands/geolookup/ does
• python3 -m unittest discover -s tests → 123 tests, OK
• python3 feed_audit.py --check → all feed modules satisfy the load contract, exit 0

Docs-only change: no code paths touched.

Note on provenance

This commit was authored 2026-07-07, alongside #257, and was meant to go out with it. It sat unpushed on a local branch until now, and briefly landed on the already-merged feat/feed-module-contract-test branch by mistake before being moved here. Content is unchanged from the original commit; only the branch is new.