v2.8.1 - drop bogus traceroute TSPU-hop scoring (correctness)

TSPU/DPI/VPN detectability scanner, v2.8.1 (correctness patch).

fix: traceroute "TSPU mgmt-subnet" removed from the verdict

earlier versions penalised the score (and raised a TSPU-verdict B-tier hit) when a traceroute hop landed in 10.X.Y.[131-235]/[241-245]/254, calling it a "TSPU management subnet on the path". that was wrong (thanks to the reporter on ntc.party):

• TSPU is a bump-in-the-wire DPI box, transparent at L3: it does not decrement TTL and never appears as its own traceroute hop, so it cannot be detected by trace at all.
• 10.x hops are ordinary operator link addressing and mean nothing about TSPU.

so the score penalty and the TSPU mgmt-subnet in traceroute verdict rule are both removed. private-10.x hops are now an honest informational note only (no score impact, no TSPU-tier impact). the count is still in --json for reference.

everything else is unchanged from v2.8.0. 76 unit tests / 3299 assertions green under -Werror.

verify

byebyevpn.exe                sha256: d30317028cc67faef76ef26cdb5a3fe128c45fd0d1d84eed10985ada0fca94b6
byebyevpn-v2.8.1-win64.zip   sha256: 54843c5c0cd80f728317bdb4ea19cad944f71e64bee4c5497073c7fff3f52d7f

runtime: Windows 10 1803+ / 11 / Server 2019+. no admin, no DLLs, no .NET. Linux/macOS via Wine.