test(reverse-whois): record the 0.60/0.30 calibration basis and pin #122's Jaccard arms (ENG-5374)

CLAUDE.md

@@ -110,7 +110,7 @@ The reverse-whois domain plugins (`reverse-whois` over ViewDNS, `whoxy-reverse-w
 
 - **`registrantResolver`** resolves each candidate's registrant org — **RDAP primary** (`github.com/openrdap/rdap`, pooled per-worker `*rdap.Client` via a pre-filled fixed-size channel that survives GC — a shared client is unsafe for concurrent `Do`, and `sync.Pool` evicted warm clients mid-pass (ENG-5376)), **WHOIS fallback** (`whoisclient.go`) when RDAP yields nothing. `registrantOrgFromDomain` reads the registrant entity's jCard `org` (falling back to `fn`).
 - **`verifyCandidates`** compares the resolved registrant org against the query org (normalized similarity) and assigns per-candidate confidence rather than one flat score:
-  - corroborated (similarity ≥ 0.60) → `confReverseWhoisCorroborated` = 0.60
+  - corroborated (similarity ≥ 0.60 **and** the comparison has resolution) → `confReverseWhoisCorroborated` = 0.60. Resolution (`corroborationHasResolution`) means `minCorroborateTokens` (2) **distinct** normalized tokens on both sides — distinct, because the metric credits a repeated token once per occurrence, so a raw token count would let one shared token pose as two independent ones — **or** exact normalized equality, the exemption that keeps the legitimate "Praetorian" vs "Praetorian Inc" corroborating. Similarity is the containment coefficient `m / min(kq,kc)`, so without that floor a single-token query org saturates it at 1.0 against any registrant merely containing that token, and no choice of cutoff repairs it (ENG-5374).
   - masked / unresolved registrant → `confReverseWhoisUnverified` = 0.50 (needs review)
   - mismatch → `confReverseWhoisMismatch` = 0.40 (needs review)
   - `decideConfidence` returns a `confidenceDecision{Score, Justification}` and the caller makes **one** `AddConfidence` call with it. These three are mutually exclusive classifications of a single verification operation, not independent additive signals — emitting them as separate entries would let a candidate accumulate contradictory evidence and climb out of the review band. Justifications describe the *relation* to the queried org ("corroborates", "differs") and never reproduce the resolved registrant, which is the same WHOIS/RDAP PII this plugin declines to log.