0.4.9 — two live-caught fixes: RM_RF filename FP; block outranks warn

Fixed

• RM_RF no longer false-blocks filenames that look like flags. Caught live during the 0.4.8 release: rm /tmp/pypirc-fresh was vetoed because the old whole-line lookahead read -fre inside the filename as an -fr flag. Flags are now matched as tokens (rm "-rf" / still blocks) and the match stays inside one command segment (rm x && tar -rf a.tar y is no longer blamed on rm). All dangerous spellings stay caught: -rf, -fr, -Rf, -rfv, -vrf, -Rfi, split -r -f / -f -r.
• Block-level policy outranks warn-level in attribution, order-independent. Caught live productizing the policy packs: attribution was first-match-in-list-order, so the core generic net HTTP_API_DELETE_GENERIC (warn) silently downgraded a hard danger an operator pack's block rule also matched — GATECAT_EXTRA_POLICIES appends packs after the built-ins. Attribution is now two-pass (block first, then warn): a hard match is never degraded by list order; a warn-only match still warns.

Full suite: 1005 passed, 27 skipped. Bypass suite: 70/70 dangers, benign corpus grown by the filename-substring class.