Learned excuses: match bracket-style field names, count query names read during a check #1729

Follow-ups from the round-3 independent review of #1679 (#1679 (comment)).

1. Bracket-style names such as note[email] are recorded as-is and never matched to the email column, because _names splits only on .. This predates the PR for form bodies, and the new query-string code has the same gap. Split on brackets too, so a column the agent sends is never learned.
2. record_bodies._check copies the query names before the check's own reads, so a GET that arrives during those reads isn't counted for that episode. The window is small (checks run after quiet_s of idleness), but the copy should be taken after the reads.