fix(dynamic-rules): apply each rule version over the base config

[rennf93]

Closes #168

DynamicRuleManager._apply_rules now restores _active_base_snapshot before applying a new version or a different rule, so each version is an overlay on the base config and not on the previous version. A failed apply rolls back to the state before the attempt (the previously active version), and the base snapshot stays on the true base. Expiry is unchanged and still restores the base. The restore deep-copies the snapshot values so the retained base cannot be mutated through the live config.

Before this, _activate_emergency_mode halved auto_ban_threshold again for every emergency version (16, 8, 4, 2), and a version that stopped setting a field kept the value the previous version set.

Effects outside the config: IP bans keep their current behavior (a ban is a timed record that is re-applied idempotently and is not undone on expiry). Suspicious patterns added by a rule were appended to the registry again for every version that repeated them, so _apply_pattern_rules now skips patterns the registry already holds. Patterns still persist after expiry, as before.

test_concurrent_rule_application_serializes and its sync twin asserted that the second concurrent apply observed the first one's result; with the overlay both observe the base, so they now assert that.

Verification: unasync check, pre-commit run --all-files, make quality, and the full pytest suite with -W error --cov-branch --cov-fail-under=100 against host Redis all exit 0.

[github-actions]

Detection gate report

All detection gate shards passed.

Shard arbiter-grammar

Gate green: no category regressed against its committed baseline and no benign string is newly flagged.

Total recall: n/a. Total false-positive rate: n/a.
Documented known gaps: 0. Documented known false positives: 0. Both stay in the denominators.

Full per-case output is in the job log.

Shard benchmarks-and-rest

Gate green: no category regressed against its committed baseline and no benign string is newly flagged.

Total recall: 378/386 (97.9%). Total false-positive rate: 23/370 (6.2%).
Documented known gaps: 8. Documented known false positives: 23. Both stay in the denominators.

Category	Recall	False positives
cmd_injection	38/46 (82.6%)	10/370 (2.7%)
cms_probing	36/36 (100.0%)	0/370 (0.0%)
code_injection	3/3 (100.0%)	0/370 (0.0%)
deserialization	18/18 (100.0%)	0/370 (0.0%)
dir_traversal	10/10 (100.0%)	0/370 (0.0%)
file_inclusion	16/16 (100.0%)	3/370 (0.8%)
file_upload	32/32 (100.0%)	0/370 (0.0%)
http_split	4/4 (100.0%)	0/370 (0.0%)
ldap	25/25 (100.0%)	0/370 (0.0%)
nosql	10/10 (100.0%)	0/370 (0.0%)
path_traversal	13/13 (100.0%)	0/370 (0.0%)
proto_pollution	8/8 (100.0%)	0/370 (0.0%)
recon	23/23 (100.0%)	0/370 (0.0%)
sensitive_file	16/16 (100.0%)	0/370 (0.0%)
sqli	38/38 (100.0%)	6/370 (1.6%)
ssrf	32/32 (100.0%)	4/370 (1.1%)
template	13/13 (100.0%)	1/370 (0.3%)
xml	4/4 (100.0%)	0/370 (0.0%)
xss	39/39 (100.0%)	0/370 (0.0%)

Full per-case output is in the job log.

Shard builtin-safety

Gate green: no category regressed against its committed baseline and no benign string is newly flagged.

Total recall: n/a. Total false-positive rate: n/a.
Documented known gaps: 0. Documented known false positives: 0. Both stay in the denominators.

Full per-case output is in the job log.

Shard cpu-load-arbiter-grammar

Gate green: no category regressed against its committed baseline and no benign string is newly flagged.

Total recall: n/a. Total false-positive rate: n/a.
Documented known gaps: 0. Documented known false positives: 0. Both stay in the denominators.

Full per-case output is in the job log.

Shard cpu-load-benchmarks-and-rest

Gate green: no category regressed against its committed baseline and no benign string is newly flagged.

Total recall: 378/386 (97.9%). Total false-positive rate: 23/370 (6.2%).
Documented known gaps: 8. Documented known false positives: 23. Both stay in the denominators.

Category	Recall	False positives
cmd_injection	38/46 (82.6%)	10/370 (2.7%)
cms_probing	36/36 (100.0%)	0/370 (0.0%)
code_injection	3/3 (100.0%)	0/370 (0.0%)
deserialization	18/18 (100.0%)	0/370 (0.0%)
dir_traversal	10/10 (100.0%)	0/370 (0.0%)
file_inclusion	16/16 (100.0%)	3/370 (0.8%)
file_upload	32/32 (100.0%)	0/370 (0.0%)
http_split	4/4 (100.0%)	0/370 (0.0%)
ldap	25/25 (100.0%)	0/370 (0.0%)
nosql	10/10 (100.0%)	0/370 (0.0%)
path_traversal	13/13 (100.0%)	0/370 (0.0%)
proto_pollution	8/8 (100.0%)	0/370 (0.0%)
recon	23/23 (100.0%)	0/370 (0.0%)
sensitive_file	16/16 (100.0%)	0/370 (0.0%)
sqli	38/38 (100.0%)	6/370 (1.6%)
ssrf	32/32 (100.0%)	4/370 (1.1%)
template	13/13 (100.0%)	1/370 (0.3%)
xml	4/4 (100.0%)	0/370 (0.0%)
xss	39/39 (100.0%)	0/370 (0.0%)

Full per-case output is in the job log.

Shard cpu-load-builtin-safety

Gate green: no category regressed against its committed baseline and no benign string is newly flagged.

Total recall: n/a. Total false-positive rate: n/a.
Documented known gaps: 0. Documented known false positives: 0. Both stay in the denominators.

Full per-case output is in the job log.

Shard hardening-canaries

Gate green: no category regressed against its committed baseline and no benign string is newly flagged.

Total recall: n/a. Total false-positive rate: n/a.
Documented known gaps: 0. Documented known false positives: 0. Both stay in the denominators.

Full per-case output is in the job log.