Rebuild: first end-to-end runs; prefetch per chunk, executable rule, wire fixes

End to end on the workstation (coordinator:run, the API, edge:node, real
NNTP): a.b.e-book.french and a.b.cd.image.playstation2.dvdiso ranges.

- Prefetcher: every connection takes the next missing chunk (leased
  ranges first, in order); one connection per range (~26k lines/s) kept
  the worker waiting
- executable rule: releases of bare executables (malware floods named
  after films and software) are dropped; they were 92% of the catalog rows
  of the test ranges, 21% of the segments
- fragments per file (details once) and gzipped batch bodies; the JSON
  limit (1 MB by default) raised to 256 MB, empty strings kept (a rule
  count's key is '')
- release_chunks.batch_from is a bigint (boneless article numbers)
- tests get their own database; edge:bench --store times BatchStore:
  1.3 s for a boneless range (1.24 ms per release chunk)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/services/rule_sets.ts

@@ -12,12 +12,15 @@ class RuleSets {
   async current(): Promise<Rules> {
     let row = await db.from('rule_sets').orderBy('version', 'desc').first()
     if (!row) {
-      const { version: _v, ...rules } = DEFAULT_RULES
+      const { version: _version, ...rules } = DEFAULT_RULES
       await db.table('rule_sets').insert({ version: 1, rules: JSON.stringify({ ...rules, droppedSignatures: [] }), note: 'default' }).onConflict('version').ignore()
       row = await db.from('rule_sets').orderBy('version', 'desc').first()
     }
     const groups = await db.from('groups').where('active', true).select('name', 'priority')
+    const { version: _v, ...defaults } = DEFAULT_RULES
     return {
+      // A field newer than the stored set takes today's default.
+      ...defaults,
       ...(row.rules as StoredRules),
       version: Number(row.version),
       priorities: Object.fromEntries(groups.map((g) => [g.name, Number(g.priority)])),