feat(search): ioc --with-artifacts returns the matching artifacts' metadata

[vhmartinezm]

Summary

polyswarm search ioc ip|domain|ttp|imphash <value> gains a --with-artifacts flag. It calls search_by_ioc(with_artifacts=True) and prints each row with the same formatter as search metadata, so the text, json and hash output formats all work. The short_help now covers both directions: "Retrieve IOCs by artifact hash, or artifacts by IOC."

Semantics

• Without the flag, output is unchanged.
• On a hash lookup (search ioc sha256 …), the flag is refused as a usage error (exit 2). It is not silently ignored.
• The SDK floor rises to polyswarm_api>=4.7.0.

Requires

• polyswarm/artifact-index#1997 (server support for with_artifacts). Deploy it first.
• polyswarm-api PR: feat: search_by_ioc(with_artifacts=) returns artifact metadata rows polyswarm-api#329 (adds search_by_ioc(with_artifacts=), version 4.7.0). CI resolves it from the same-named branch.

Tests

tests/search_test.py mocks the SDK method, as the repo's testing spec allows. It covers:

• the flag being passed through;
• the default call being unchanged;
• the usage error on hash lookups;
• the text, json, sha256, sha1 and md5 output formats on a with-artifacts row.

[claude]

Clean against AGENTS.md and specs/: it targets develop, leaves the package version alone, raises the SDK floor in the pin, adds a ## Requires link, updates specs 02 and 05, and mocks at the SDK boundary with autospec. One action: the branch name has a ticket prefix, so squash-merge with an explicit clean subject (AGENTS.md § Commit + PR hygiene) so the ticket ID stays out of develop history.