v3.8.2 — Recognize verified security policies

Fixes the one-click security installer incorrectly reporting custom changes for previously verified combined protections. Network and subsite Install security rules now recognize the approved rollout only when both custom-rule and rate-limit fingerprints match the saved mapping for that exact zone. Verified policies and intentional exceptions are preserved without splitting or duplicating rules. New-site installation and normal missing-rule/conflict checks remain in place.

Also accepts Cloudflare's omitted rules field on existing empty security rulesets.

Validated against all 153 saved rollout configurations, edited combined protections, changed rate limits, wrong-zone mappings, empty ruleset installs, fresh installations, partial retries and cache recovery regressions. GitHub validation must pass before publication.