Heal execute: quarantine markers, re-enable DNP voiding, two exclusion scopes

Order 2 Phases 2 + 4. Pre-heal rollback point secured first:
vyndr-20260720-093821.dump (856,890 bytes) VERIFIED ON THE BOX, not just
exit 0.

MIGRATION 027 — two DISTINCT exclusion scopes, deliberately separate:
- quarantine_reason: the row's GRADE is untrustworthy (wrong_opponent_grade).
  The row REMAINS a real public settled result — the bet happened, the
  outcome is real — but it must never train or validate, so
  getModelAggregate now excludes it from the denominator alongside
  void/unrecoverable.
- analysis_flags: the row is VALID for settlement and the record but
  unattributable for PER-GAME analysis (doubleheader dates). Explicitly NOT
  filtered from aggregates.
Collapsing these would either wrongly drop 166 doubleheader rows from the
record or wrongly keep 25 wrong-opponent grades inside model validation.
Tests assert both directions, including that analysis_flags is NOT filtered.
Also adds re_settled_at + settlement_source to model_snapshots.

DNP VOIDING RE-ENABLED — reversing my own Order 1.5 disable, with scrutiny,
because its premise was FALSE. Order 1.5 assumed a missing player row meant
the row's DATE was wrong. The Phase 0 dry-run disproved it: across every
bindable row the stored date matched a real game (MIS-DATED: 0), and the
players I had cited as counter-evidence were genuine DNPs on their true
dates (Freeman 07-18; Kwan/Hedges/Davis 07-17 — their teams played, they
did not). The evidence is positive: games FINAL + no line in a full-season
log = no bet existed.

I got this wrong twice tonight in opposite directions; the dry-run is what
caught it. Recording the reasoning in the code so the next reader sees why
the flag flipped back.

Suite 282/3386 green, build exit 0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SmNjJAwEnqHPtXbvSZR8kA

src/services/ledgerService.js

@@ -564,6 +564,13 @@ async function getModelAggregate(opts = {}) {
     // enter a record denominator, exactly as pushes are excluded from hit_pct.
     // Without this, voiding a row would silently move the public record.
     .not('outcome', 'in', '("void","unrecoverable")')
+    // Session 64 (Order 2) — QUARANTINE. A row whose GRADE is untrustworthy
+    // (wrong_opponent_grade) stays a real public settled result but must never
+    // train or validate a model, so it leaves the denominator exactly as
+    // void/unrecoverable do. NOTE: `analysis_flags` (e.g. doubleheader) is
+    // deliberately NOT filtered here — those rows settle validly and belong in
+    // the record; they are excluded only from per-game/opponent analysis.
+    .is('quarantine_reason', null)
     // 2026-07 — a grade with a non-positive model_value had NO real projection
     // (the pre-fix degradation). Those locks are kept in the append-only ledger
     // but must not count toward the public model record — their hit/miss is