Fix forbidden phrase boundaries and guard scoped link ownership

[lanyue-llk]

forbidden_any matched Not Found inside the legitimate Globo column label Page Not FoundExtra, rejecting an otherwise accepted homepage. The shared matcher now checks ASCII word boundaries in both returned text and reference exemptions. Complete error phrases still fail; CJK phrases keep their existing substring behavior.

Add paired public score_attempt / task_passed controls for forbidden phrase collisions and scoped Markdown caption ownership, with root causes and regression IDs in evaluation/scoring-regressions.json.

Joyn remains a failure under its existing contract: it requires a visible card caption owned by the detail link. The saved Markdown has explicit title links elsewhere, but lacks the required caption representation. Its first Mehr Infos link follows “The Masked Singer” and points to JENKE. Borrowing nearby text would create a false record. The contract and named-link parser remain unchanged.

Validation:

• Focused scoring, regression, revision, diagnosis and review tests passed.
• Ruff and track naming checks passed.
• Offline comparison of all 202 retained attempts against the latest main matcher changes only Globo: fail → pass, with 15 records and all 18 anchors. Joyn remains fail with 0 qualifying records against a minimum of 12.
• No provider calls, stored verdict changes or publication changes.

[lanyue-llk]

This change is fully represented in #42 by the rebased aggregate commit 8f21846e (including the paired scoring controls). Keeping this PR open would leave two competing integration paths, so #42 is the sole delivery PR.