feat(source-authority): cover the ops/infra canon — project-doc hosts + SE-network domains (#130)

[askalf]

Why

Closes #130. The v0.26.1 board's one dead row (niche-ops: 0 primary kept on both sides) traces partly to scorer coverage: nginx.org — the canonical doc host for the question's literal fix (proxy_buffer_size) — scores unknown (not curated, no docs. prefix), and the SE network's flagship ops sites (serverfault.com/superuser.com/askubuntu.com) also score unknown because they are NOT subdomains of stackexchange.com. Full pool evidence in #130.

What

• PRIMARY_DOMAINS += nginx.org, apache.org, kernel.org, php.net, git-scm.com — official project-doc hosts with no docs. prefix, same class as the existing redis.io/postgresql.org entries.
• REPUTABLE_DOMAINS += serverfault.com, superuser.com, askubuntu.com — same trust class as the already-listed stackoverflow.com.
• Boost-led and auditable per the module's philosophy; no denylist changes, no heuristics.

Tests

+2 pinned cases (ops/infra primaries incl. the httpd.apache.org subdomain path; SE-network domains + a *.stackexchange.com regression pin). Full suite 775 pass / 0 fail / 2 skip; build clean.