Fix mixed tracker evidence expiry

[kasnder]

Problem

A standard-mode mixed tracker/non-tracker allow verdict used only the selected tracker row's expiry. When its benign evidence expired first, the cached allow remained active and tracker traffic could stay allowed until an unrelated, longer tracker TTL elapsed. The DDG/minimal mixed verdict had the same lifetime mismatch.

Change

Mixed verdicts now expire at the earlier of the selected tracker evidence and the last opposing evidence row. Multiple benign rows continue to justify ambiguity until the last one expires. Expiry addition saturates instead of overflowing.

Validation

• ./gradlew :app:testGithubDebugUnitTest -q
• ./gradlew :app:compileGithubDebugJavaWithJavac -q
• focused tests cover early benign expiry, multiple benign rows, DDG/minimal evidence, and long bounds

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T21:27:15.992737Z	292b888	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.