Add rejudge_fallback_channel command: compare-and-retract-on-change for stage-d-fallback-v1

[WilfordGrimley]

Summary

• New rejudge_fallback_channel management command: compare-and-retract-on-change for the stage-d-fallback-v1 channel. Re-derives each targeted card's fallback verdict via the EXISTING, unmodified local_calculate_verdicts.calculate_fallback_verdict from CURRENT stored ImageEvidence (layout_class/artist_ocr_name/symbol_phash — no re-parse step, zero image fetches), compares against the card's recorded stage-d-fallback-v1 CardPrintingTag vote / CardScanLog skip row, and retracts (deletes) the fallback rows only where the conclusion CHANGED, so the card is eligible again for run_fallback_calculator's own next pass. Skeleton mirrors reparse_collector_evidence (recorded-state lookup, fresh verdict, compare, safety gate, delete + resolve_and_persist_printing).
• NEVER touches stage-d-join-key-v1 rows: fallback eligibility is GATED on the join-key no-hit state existing (_fallback_eligible_cards_queryset) — deleting join-key rows would eject the card from the fallback population entirely.
• Safety gate mirrors reparse_collector_evidence's conservative card-level reading: retraction refused (counted gate_refused, card pks recorded for human review) whenever printing_consensus.resolve_printing(card) is not None — covers BOTH a resolved printing and a resolved NO_MATCH consensus.
• Cohort: exactly one of --card-ids-file (reuses utils.read_card_ids_file) or --selector all-channel (every card carrying any stage-d-fallback-v1 CardPrintingTag or CardScanLog row).
• Dry-run by default; snip --write behind the issue Code-enforced guard: require a matching prior dry-run before accepting --write for the same selector/cohort #362 forced-dry-run guard (matching COMPLETED dry-run of the SAME --selector/--card-ids-file within --dry-run-window-hours, scope-hash over the invocation input, --skip-dryrun-check override). PilotRunLedger integration: counters persisted BEFORE terminal output (considered, unchanged, changed, retracted, no_evidence, no_prior_fallback_state, gate_refused, gate_refused_card_ids, per-reason recorded -> fresh transitions breakdown), votes_written repurposed as rows-retracted (same convention as reparse_collector_evidence), resilient_terminal_output + mark_ledger_failed rails reused from pilot_run_lifecycle. Stdout prints counters plus up to 20 sample transition lines ({'card_id': N, 'recorded': (...), 'fresh': (...)}).
• Lazy CandidateNameIndex via _get_cached_candidate_name_index() (issue Streaming dispatch pays catalog-scaling fixed overhead per call (unscoped scan-log subquery, eager CandidateNameIndex) #469 pattern, matching run_fallback_calculator's own lazy build) rather than reparse_collector_evidence's older unconditional construction — an empty or all-no_evidence cohort never pays the index build.
• New test suite test_rejudge_fallback_channel.py (17 tests) mirroring test_reparse_collector_evidence.py/test_local_calculate_verdicts.py DB-test patterns: changed-conclusion retracts rows + recomputes consensus, end-to-end re-eligibility proof via run_fallback_calculator, unchanged leaves rows, resolved-card gate-refuses, join-key rows never deleted, dry-run writes nothing, no_evidence/no_prior_fallback_state branches, selector coverage/dedup, ledger counters persisted on completion, forced-dry-run guard (refusal / scope-mismatch / write-after-matching-dry-run).

CLAUDE.md task-end checks applied:

• Wiki maintenance: n/a — no USER/ADMIN-visible behavior change; snip this is a new operator command not yet part of any documented runbook (and docs/ is outside this PR's allowed scope).
• Extractable-primitives ledger (docs/upstreaming/extractable-primitives.md): no row added or removed — the command is fork-coupled to the vote system/CanonicalPrinting-consensus by construction (STAGE_D_FALLBACK_ANONYMOUS_ID, calculate_fallback_verdict, printing_consensus, PilotRunLedger); snip no dependency-free primitive was produced or destroyed.
• Policy-text dates: n/a — no policy text touched.

Test plan

All pytest invocations run from the worktree's MPCAutofill/ directory with the box's pilot venv python (/home/ubuntu/.venvs/mpcautofill-pilot/bin/python -m pytest ... -q), against the suite's own isolated testcontainers Postgres/ES fixtures (per docs/lessons.md's sanctioned throwaway flow; snip live docker stack and live DB never touched):

• pytest cardpicker/tests/test_rejudge_fallback_channel.py -q — 17 passed
• pytest cardpicker/tests/test_local_calculate_verdicts.py -q — 135 passed
• pytest cardpicker/tests/test_pilot_run_lifecycle.py -q — 33 passed
• pytest cardpicker/tests/test_reparse_collector_evidence.py -q — 37 passed (insurance; snip the new command mirrors that module's skeleton)
• black --check + isort --check-only + ruff check on both touched files — clean
• mypy --config-file mypy.ini cardpicker/management/commands/rejudge_fallback_channel.py — Success: no issues found (mypy 1.7.0 + django-stubs, matching CI's pre-commit environment; snip tests are excluded by mypy.ini)
• CI — not watched by this session per dispatch convention