Drop Avoid, Tombstone, and ancillary Interstitial VF verdicts

[Pitchfork-and-Torch]

Wave 5 hunter #1

Identity: Pitchfork-and-Torch (297513015). Surveyed open Pitchfork PRs on xai-org/x-algorithm (#96–#142) and Pitchfork-and-Torch/x-algorithm (none open).

This is not #96/#140 (mute keyword text). This is not #100/#101/#108/#137 (hard mute/block graph). This is not #121 (primary/ancillary VF Err / missing key). #121 leftover: a child Interstitial still fails open.

Bug

VFFilter::should_drop and should_drop_reason only hid Action::Drop. Soft VF actions fail open:

• Strato homeMixerFilteredReason.Tweet decodes to SafetyResult { action: Avoid } (vf_client sample). Avoid is hide-from-timeline / suppress. The filter kept it.
• Tombstone and NotEvaluated (None action on a present SafetyResult) also kept.
• Ancillary Interstitial on a quote, reply ancestor, or retweet source did not set drop_ancillary_posts. Home Mixer has no warning UI on the wrapper, so the viewer still sees the child.

Ok(None) / Action::Allow / primary Interstitial (TimelineHome NSFW warning) / Downrank are unchanged. Primary Err / missing key stay #121.

• Entry: Strato/Xai VF SafetyResult.action; should_drop_ancillary
• Sink: VFFilter; AncillaryVFFilter via drop_ancillary_posts
• Break: soft hide decoded as Allow
• Viewer effect: a muted/suppressed/tombstoned post, or a quote/reply of an interstitial child, still serves
• Twin: Fail closed when primary VF lookup is Err or missing #121 fail-closes lookup miss. This fail-closes the soft verdict.

Fix

Primary: drop Avoid, Tombstone, NotEvaluated. Keep Interstitial / Downrank / Allow / None.
Ancillary: drop those plus Interstitial on the child.

Tests

• Primary Avoid / Tombstone / NotEvaluated drop; Interstitial / Downrank / None keep
• Ancillary Interstitial / Avoid / Tombstone / NotEvaluated / Drop drop the wrapper
• Ancillary Allow / Downrank / Ok(None) keep
• Tombstoned ancestor still skipped
• Standalone decision table: 17 assertions passed

cargo test cannot run. Public dump has no Home Mixer manifest.

Fork PR: none