Rank rules on evidence, and gate TCP/TLS on the endpoint

[hellais]

Two corrections to the scoring cascade. Both change which rule id is recorded rather than the scores themselves.

top_*_rule_id was argMax(rule_id, blocked). On a measurement that is not blocked the key is 0 on every row, so argMax kept whichever row it saw first. Every web_connectivity measurement carries one row per resolved IP plus one per redirect hop, and the redirect rows hold only HTTP, so they scored no_tls_data and were winning that tie. Rules now carry an Evidence level and are ranked on it before the score.

DNS scoring was restricted to the system resolver and its window partitioned without the resolver, so every DNS signal was constant across a measurement and a row whose address came from another resolver inherited the system resolver's verdict. dns_untrusted is replaced by endpoint_untrusted, which additionally requires that nothing independent vouches for the address: either the control returned it too, or somebody completed a valid handshake for the expected name on it.

RULES_VERSION goes to 2, so rows written before and after are distinguishable. Measured over a 10-minute production window (9,731 measurements), rescoring with the new code moves no *_blocked score and three rule ids, all tcp: endpoint_untrusted -> none. The new condition is strictly narrower than the one it replaces, so it can only unmask rows, never mask new ones. It is close to a no-op until web_connectivity 0.5 measurements reach the pipeline, which is what makes it safe to land first. Reprocessing steps are in the migration notes.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 83.77%. Comparing base (440ff2d) to head (d5e4e0f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #173      +/-   ##
==========================================
+ Coverage   77.87%   83.77%   +5.90%     
==========================================
  Files          33       89      +56     
  Lines        1939     5714    +3775     
==========================================
+ Hits         1510     4787    +3277     
- Misses        429      927     +498     

Flag	Coverage Δ
oonidata	77.87% <ø> (ø)
oonipipeline	86.80% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.