Rollout snapshot freshness and CT scoring

Rollout snapshots now declare freshness explicitly and the Connecticut scoring path is fixed, so trust badges no longer disagree across the four canonical surfaces.