VENUS-327: extend SCANNER_PROBE_RE + pin hold-out fixtures (classifier-coverage only)

VENUS-327 mars leg, final ruling 2026-07-30 (pmmaster+audit-venus-ca): classifier-coverage only, no rail predicate. Extend + regression-test SCANNER_PROBE_RE in src/lib/not-found-classify.ts for executed-unmatched scanner families: /phpinfo (no literal dot, \.php[0-9]* misses — pinned cross-rail with pluto), /.npmrc, /terraform.tfstate.backup (boundary fails on trailing .backup), .cgi family, config .ts paths, glob/template wordlist literals (/webhook/*, /shop/[category]/*). PIN deliberate hold-outs as real-route fixtures: /practicas/<uuid>, /login, /informes typos, /test, /signup — hold-out pins matter more than the additions since allowlist growth-by-broadening is what would swallow /login. MARS-346's no-write sink skip (pre-logEvent, EMAXCONN connection-storm fix) MUST be preserved — no new appEvents writes, no rail predicate. coder-mars-cc has not started; explicitly not deferred, awaiting priority dispatch.