fix(caller-drift): the exempt probe read one protection system, not both (backend#1681)

[LukasWodka]

The hole

evaluate_protection's exempt-staleness check was:

ifprobe.classic_present:

A branch protected solely by a ruleset returns 404 from the classic endpoint, so it read as unprotected — and its exemption stayed silently valid. The guard would never notice that a role it believes is out of scope is in fact a real, protected branch.

That is exactly the two-systems defect the 20-line header of read_protection() exists to prevent, sitting in the one place that decides whether an exemption is still true. probe.rulesets is populated by the very same call; it was just never consulted.

Why it survived

The selftest coverage stopped one path short. _ruleset_only already existed — and was only ever pointed at the required path, never at exempt. It now covers both.

The finding also names which layer covers the branch, so a reader isn't sent to re-derive the ruleset story by hand.

Test plan / evidence

check	result
selftest	111 → 117 pass, 0 fail
mutation — restore the old classic_present-only condition	the new case FAILS (findings=[])
live run, all 20 repos	"No drift. Every repo read, every entry matched."

The mutation row is the point: it proves the new test covers the hole rather than passing either way. The live row means closing this costs nothing today — no exemption was actually hiding behind it — and it catches the next one.

Found by the round-2 pipeline audit, backend#1681. Parent epic: backend#1680.

---

Note

Low Risk
Narrows a guard false negative in offline-tested drift logic; no auth or runtime API behavior beyond more accurate staleness detection.

Overview
Fixes a fail-open in evaluate_protection when inventory marks a branch role as exempt: staleness used to fire only on probe.classic_present, so a branch protected only by a ruleset (classic 404) looked unprotected and the exemption stayed valid.

The exempt probe now treats classic_present or probe.rulesets as protected, and findings say whether coverage is classic protection or a named ruleset. A selftest reuses the existing _ruleset_only stub on the exempt path so ruleset-only protection must report a stale exemption.

^{Reviewed by Cursor Bugbot for commit 8ca024f. Bugbot is set up for automated code reviews on this repo. Configure here.}