Fix evidence test failures and clean up redundant tracker domains

[alex-w-developer]

Summary

The evidence test could report missed trackers and still pass, and it never checked whether legitimate requests were blocked. It now fails on either mismatch and prints the fixture, URL, and expected result.

What changed

• Added a catalog check that catches child domains already covered by a parent. Intentional overlaps need a redundancyReason; unexplained overlaps stop generation before files are written.
• Removed 10 redundant entries, taking the catalog from 80 domains to 70. Their endpoint notes now live on the parent entries. Kept stats.g.doubleclick.net and static.ads-twitter.com because they add different category signals.
• Added 30 request fixtures and tooling tests for failure exit codes, domain boundaries, retained categories, and repeatable generation. The tooling tests run in the existing CI check.

Blocking coverage and category coverage are unchanged. The audit table and contributor docs explain the decisions.

How tested

• npm run generate:rules
• npm run test:evidence: all 60 request fixtures pass, including 44 tracker requests and 16 negative cases.
• npm run check: tooling tests, Decoy Mode tests, syntax, JSON, generated-file consistency, and safety checks pass.
• Compared the generated domain lists and every category against current main in both directions; coverage is equivalent and other DNR settings are unchanged.
• git diff --cached --check

No UI changes. Browser tests were not run; the local evidence evaluator still has the third-party matching limitation tracked in #17.

Closes #13
Closes #21
Closes #22