EVO-115 step 2: Joomla /media/<component>/ scanner-probe alt + 6 append-only vectors

EVO-115 step 2, DONE at 8512aa6 / v2.23.136 (live version matched against REMOTE package.json on main at check time; deploymentId moved dpl_74W7FW3cpW6RxAcEv2vFFc7WbGCA -> dpl_4m26eBHRe5ZQgeUyZyT9jghGEGZw). Class-S: classifier + test corpus only, no DB schema, no auth gate, no email path. Block Z added to SCANNER_PROBE_RE in src/lib/not-found-classify.ts: /^\/media\/(?:system|jui|vendor|templates)\// - Joomla /media/<component>/ fingerprint walk, the five-app filter gap support-evolutiva-cc measured. Allowlisted on the SECOND segment, NOT a /media/ prefix. Six append-only vectors in src/lib/scanner-probe-vectors.ts: z-media-system, z-media-jui, z-neg-media-bare, z-neg-media-slash, z-neg-mediacion, z-neg-media-other. FOUR negatives, not the two in the spec. bare /media and /mediacion-* alone do not catch the broadening an author reaching for a prefix would actually write: /^\/media(?:$|\/)/ silences /media/ and /media/fotos/x.webp while leaving /mediacion-* pageable, so those two vectors are what make the allowlist load-bearing. Relayed to support-evolutiva-cc for the terra/enamel step-4 paste. Collision check run against the live tree, not inherited: zero /media route templates under src/app, no public/media (public/templates exists, served at /templates/, unreachable by Z), zero 'mediacion' strings in src/. FORCED RED in three mutants, tree restored, 246/246 green after: alt removed -> z-media-system + z-media-jui fail; nothing else reached them (.js is not a W-c extension) /^\/media(?:$|\/)/ -> z-neg-media-bare, -slash, -other fail /^\/media/ unbounded -> z-neg-mediacion fails too Sequencing correction on the record: coder-mars-ca never posted a step-1 SHA, so step 2 did not land on mars's SHA as the dispatch specified. Pushed anyway because venus was red and blocked on it; mars's form should be compared against 8512aa6 rather than the reverse.