404 classifier: preview-crawler traffic is a third class, decide handling

Social link-unfurl crawlers (facebookexternalhit/1.1 Facebot Twitterbot/1.0) hit Pluto 404s. They are neither malicious (so not the SCANNER_PROBE_RE family) nor a real user (so counting them as friction inflates /admin/friction). not-found-classify.ts has no notion of them. Evidence: PLUTO-689 follow-up. /completar-perfil measured 2 hits ever, 26 days apart, both referrer=null, isAuthenticated=false, different IPs, both that UA. No browser has ever hit the path. CONSTRAINT (load-bearing): do NOT fold the UA into SCANNER_PROBE_RE. That regex keys on PATH; this would key on USER-AGENT - a different mechanism, and UA is trivially spoofable, so a UA-keyed silence could mask a real 404 that a path-keyed rule never would. If handled at all it needs its own tier/field and its own test pins. Scope first: measure how much 404 volume this class actually accounts for before writing code. May be a no-op.