feat(scoring): gate Rule 1's near-Nyquist 320 kbps signature on wall hardness

[Guillain-RDCDE]

What

A 320 kbps MP3 low-passes at ~20.5 kHz — exactly where genuinely band-limited lossless (baroque, harpsichord, older mastering, world-music reissues) also rolls off. Rule 1 used to flag both as a "320 kbps spectral" transcode from the cutoff position alone. On a full-library audit that single path accounted for ~65% of all FAKE_CERTAIN verdicts, the large majority of them authentic.

Rule 1 now measures the residual spectral floor above the wall, which cutoff position cannot provide: a real 320k brickwall drops to digital silence, while an authentic rolloff keeps an analog/dither floor.

• residual > -55 dB → authentic band-limited → signature dropped (file reads AUTHENTIC)
• residual <= -55 dB → digital-silence floor → stays FAKE_CERTAIN

Why a single threshold, not a 3-band WARNING

An intermediate band that withholds the +50 lets the score fall below the fast FAKE_CERTAIN short-circuit, after which protective rules (e.g. R7 clean-silence -50) can wrongly clear a genuine transcode — observed end-to-end on a confirmed real @320 file. Keeping real transcodes at +50 preserves that short-circuit.

Validation

• Calibrated on 50 synthetic FLAC→320k pairs + a band-limited surrogate (residual ROC AUC 0.95); wall205 slope was tried and dropped (AUC 0.71, fails on 256k / band-limited).
• Verified end-to-end: a real @320 transcode stays FAKE_CERTAIN; audiophile baroque/classical (Jordi Savall, New World Records) that were FAKE_CERTAIN now read AUTHENTIC.
• Residual is computed only for near-Nyquist cutoffs (90–95% Nyquist) to keep the hot path fast; unknown/short inputs fall back to the previous behaviour, so only that zone changes.

Caveats

Synthetic transcodes use LAME (ffmpeg) only; the band-limited surrogate is a gentle low-pass approximation. The threshold favours the project's "protect authentic first" rule — transcodes of already-band-limited material (shallow wall, floor > -55 dB) remain near-undetectable, as with any spectral tool.

This changes verdicts (documented in CHANGELOG under Unreleased).

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.