New installs start with the hashed-address blocklist off, and DNSBL zones read right

Personal-data catalog spec, default D5 (settled 2026-09-28; built after
the v0.16.24 import's spam-rules loader landed). msbl.org's EBL is sent
a SHA-1 of every email address it's asked about. A new install's first
boot now leaves a note, and the rules update, once the bundled rules
are in, switches STWT_MSBL_EBL_EMAIL off and forgets the note, so it
happens once; the loader keeps that switch through later updates. An
existing server has no note and keeps every blocklist as it is.

Also fixes the data inventory's DNSBL endpoints: a zone is an
expression (`ip_reverse + '.zen.spamhaus.org'`, conditional branches,
`hash(email, 'sha1') + '.ebl.msbl.org'`), and the zone names are now
the quoted literals that start with a dot, from every branch, rather
than the expression's text.

Tested: unit test for the zone rule; the compliance system test (no
note, no change; the inventory lists ebl.msbl.org, not a hash; with the
note the blocklist goes off; the note works once); the system suite;
fork checks.

crates/common/src/manager/defaults.rs

@@ -409,6 +409,10 @@ async fn insert_safe_defaults(bp: &mut Bootstrap) -> trc::Result<()> {
             bp.registry.write(RegistryWrite::insert(&object)).await?;
         }
 
+        // D5: the blocklist sent hashed email addresses starts off; the
+        // rules load later, from a task, which acts on this note
+        super::spam_rules::mark_new_install(&bp.data_store).await?;
+
         // D1: rotated log files are kept 30 days (a fork-owned setting,
         // since x:TracerLog is also stored inside x:Bootstrap)
         use inbuxa_features::security::log_files;