linux/bridge: inject the default-inbound stance into to_result

[ghostpsalm]

Four commits. main's gate has been red since 2026-08-10 — twelve consecutive runs — and this is the fix,
plus the two things that had to be true before it could land.

1. 752c237 Inject the default-inbound stance into to_result.
to_result read /etc/default/ufw itself, so the bridge tests asserted on rows built partly from the
host. That file is present on every Ubuntu runner and absent on the dev box, so
totals_reflect_everything_counted_so_far failed on CI from the moment the synthetic default-policy row
landed. The host read moved to the call sites; the tests state their stance explicitly.

2. 3de3c10 Satisfy clippy 1.98's chunks_exact_to_as_chunks lint.
Unrelated, and found only because fixing (1) let CI reach clippy at all. CI's stable toolchain moved to
1.98; the dev box is on 1.97, so this lint is invisible locally. decode_provider_data now uses
as_chunks::<2>() — clippy's own suggestion, one call site, Windows-only code. Nothing silenced.

3. 6b77365 Read the Linux default stance through one testable seam.
Commit (1) traded host-dependent tests for three untested call sites. A red-team pass proved it by
mutation: replacing all three default_policy::read(backend) arguments with None left the gate at
224 passed; 0 failed, so a regression that silently drops the default-inbound row from the evidence
header, the rule table and the socket list would have shipped green.

linux::default_policy now exposes Sources/read_from, so a test can point the ufw defaults-file walk
at a temp path and run the genuine production path without root and without a live firewall. bridge has
one stance read (to_result_from) instead of three, and fold is the old to_result body byte-for-byte.
The same mutation now fails: the_ufw_default_stance_is_read_through_the_supplied_sources, left: 1, right: 2.

4. 0fde32b the run record for the line.

Verified

• CI gate on the branch head — green (run 34029917653 on 6b77365; 0fde32b re-checked on push)
• local ./scripts/gate.sh — green; 229 passed; 0 failed (was 224 before the new tests)
• breaker: no-defect-found. Refuted a stale/None stance on every call path, an ordering skew between
  the stance and the counters, a per-tick firewall-cmd cost regression on the 5s auto-refresh, and
  "unreadable" degrading into a deny. Proved commit (2) equivalent over every length 0..64 and 2000 random
  blobs.
• seraph on 6b77365: every substantive check PASS, including a brace-matched extraction proving
  fold is the previous to_result body byte-for-byte (1916 bytes each), and that the ufw walk keeps
  first-readable-file-wins with a readable-but-keyless file yielding None without falling through.
• Authorship: an oracle agent wrote every test; a separate builder wrote the implementation and was
  forbidden from touching an assertion. Recorded in factory/runs/20260906-112236-bridge-totals-flake.json.

NOT verified

• seraph returned UNSURE twice, both on attribution only, never on substance. Commit (1) predates
  this session and has no run record at all; for (3), tests and implementation share one commit, so the
  diff alone cannot show who wrote which. The record above is the evidence, not the diff.
• Nothing asserts that the 4-arg to_result names Sources::system(). The hole shrank from three call
  sites to one line; it is not closed. Stated in the plan, not discovered late.
• main.rs:655 print_linux_report (--no-ui) still reads the stance itself, unguarded — the same
  silent-deletion shape, out of scope here. Worth its own issue.
• decode_provider_data has no test; commit (2) rests on the two expressions being equivalent, which was
  demonstrated differentially but not pinned by a test.
• The Deno receiver leg is skipped locally (Deno absent on the dev box); CI installs it and is green.
• Deploy the collector shows skipped on a PR by design — it only runs on main. Its first real run
  will be the merge commit.