fix(db): harden freedom outbounds that carry no final rules at all

[n0ctal]

Summary

Let the FreedomFinalRulesPrivateEgressBlock seeder also harden freedom outbounds that carry no finalRules key at all, or an empty one.

Why

rewriteFreedomFinalRulesPrivateEgress only rewrites an outbound when its existing finalRules are recognised as one of two shapes: allow-only (isAllowOnlyFinalRules) or the legacy private-only rule (isLegacyPrivateOnlyFinalRules). Anything else is left untouched, on the reasonable principle of not overwriting a deliberate configuration.

The gap is what falls outside both shapes at the permissive end. A freedom outbound with no finalRules key, or with "finalRules": [], is the least restricted configuration there is — nothing constrains its egress, including into private ranges reachable from the host. That case matched neither recogniser, so the seeder skipped it.

The result inverts the intent: the hardening pass fixed outbounds that already had some restriction expressed and walked past the ones that had none.

Scope

• New isUnrestrictedFreedomFinalRules(v, present) returns true when the key is absent, nil, or an empty array — the shapes that express "no restriction" rather than a deliberate policy.
• rewriteFreedomFinalRulesPrivateEgress reads finalRules with the two-value form so it can distinguish "absent" from "present but empty", and treats both as eligible alongside the two existing shapes.
• A populated finalRules that matches neither recogniser is still left alone, unchanged.

Validation

• go build ./internal/... clean.
• go test ./internal/database/ green on main at ece16559 with this applied, including new cases for the absent and empty-array shapes.
• Cherry-picks onto current main without conflict.

Risk

Low. The seeder runs once and is recorded in HistoryOfSeeders, so behaviour for already-seeded installs is unchanged. The widening is strictly toward configurations that expressed no policy; anything with rules the recognisers do not understand keeps being skipped exactly as before.