Find expired and expiring AvaTax exemption certificates

**Objective:** Review exemption certificates for `{company}` (all companies if omitted) that expire within `{days-ahead}` days (default 60) or are already invalid.

**Step 1: Pull expiring certificates**

Call `avalara-avatax-get-certificate` with `expiration-date.to` set to today plus `{days-ahead}` days, and `company` if given. Include already expired ones.

**Step 2: Pull invalid certificates**

Call `avalara-avatax-get-certificate` with `valid` = false (and `company`). Merge with step 1 and remove duplicates by `id`.

**Step 3: Classify**

* Expired: `expiration-date` before today.
* Expiring soon: within the window.
* Invalid or unverified: `valid` false, `verified` false, or an `ecm-status` or `status` that is not approved.
* Note `exempt-percentage` below 100 and missing `exemption-number`.

**Step 4: Report**

Group by class and sort by `expiration-date`. For each: id, exemption-number, exposure-zone-name, signed-date, expiration-date and the reason. Finish with counts per class and the zones most affected.

**Validation:**

* If `{days-ahead}` is not a positive number, use 60 and say so.
* If nothing is returned, say no certificates need attention.

**Rules & Guidelines:**

* This prompt is read-only. Call only the `avalara-avatax-get-*` tools named above. Never call any avalara-avatax tool that adds, updates, deletes, commits, uncommits, voids, unvoids, adjusts, refunds, locks, settles or creates anything.
* Report what the data shows. Do not guess values the tools did not return, and say so when a field came back empty.
* Use `max-records` to keep each read small, and say when a result may be truncated by it.