Fail closed when exclusive-content TES lookup errors

[Pitchfork-and-Torch]

Bug

VF ExclusiveContentHydrator asks TES get_exclusive_controls, then treats RPC Err and timeout the same as "this tweet is not exclusive."

DropExclusiveTweetContentRule only drops when exclusive_content.is_some(). timed_rpc on timeout returns an empty map (T::default()). Per-id TES Err is dropped by .ok(). Assemble then stores None. is_exclusive() is false, so the rule Allows.

TES Ok(None) still means the tweet is public. That path is unchanged.

This is not #7 (author/graph fail-open). Not #24 (safety labels / TES nsfw-nullcast-takedown flags). Not #208 (mixer SubscriptionHydrator wrapper id). Exclusive hydration is a third TES call with no fail-closed bit.

• Entry: ExclusiveContentHydrator::hydrate / timed_rpc("get_exclusive_controls")
• Sink: DropExclusiveTweetContentRule (!is_exclusive() => Allow)
• Break: TES error and timeout become None exclusive features
• Viewer effect: Super Follow exclusive posts serve to non-subscribers when exclusive-controls TES flakes
• Twin: Fail closed when safety hydration fails #7 / Fix fail-open hydration: drop tweets when label or TES flag lookup fails #24 safety_hydration_failed first-position drop

Fix

Map TES Err and hydrator timeout to ExclusiveHydration::Failed. Wire ExclusiveHydrationFailureDropRule immediately before DropExclusiveTweetContentRule on TimelineHome and TimelineHomeRecommendations. Drop with FilteredReason::ExclusiveTweet.

Successful empty TES map stays public. Super-follower Allow on a successful exclusive TES hit is unchanged.

Tests

• TES Ok(None) stays Public
• TES Ok(Some(author)) stays Exclusive
• TES Err is Failed
• Timeout fails the whole batch
• Successful empty map stays Public
• Rule + golden corpus drop Failed on Home and Recommendations
• Public tweets still Allow
• Wired rule order includes the new name

cargo test cannot run. Public dump has no visibility-filtering manifest. Verification of the change is on you.