Move status inference out of observation layer into rules

The prober (collect.go) was calling inferApexDNSKEYStatus during
zone parsing, effectively making a SECURE/BOGUS judgement inside the
collection phase rather than the evaluation phase.  The DNS-rcode
fallback (z.Status = z.DNSStatus) was also applied at parse time.

checker/collect_test.go

@@ -99,11 +99,19 @@ func TestParseGrokOutput_StringZone(t *testing.T) {
 }
 
 func TestDecodeZone_StatusFallbacks(t *testing.T) {
-	// Only top-level status; no delegation block. Status must fall back to it.
+	// Only top-level status; no delegation block.
+	// The observation layer stores DNSStatus and leaves Status empty.
+	// effectiveStatus (rule layer) is responsible for the DNS-rcode fallback.
 	raw := []byte(`{"status": "NOERROR"}`)
 	z := decodeZone(raw)
-	if z.DNSStatus != "NOERROR" || z.Status != "NOERROR" {
-		t.Errorf("expected Status and DNSStatus = NOERROR, got %+v", z)
+	if z.DNSStatus != "NOERROR" {
+		t.Errorf("expected DNSStatus = NOERROR, got %q", z.DNSStatus)
+	}
+	if z.Status != "" {
+		t.Errorf("expected Status empty (no delegation block), got %q", z.Status)
+	}
+	if got := effectiveStatus(z); got != "NOERROR" {
+		t.Errorf("effectiveStatus: expected NOERROR fallback, got %q", got)
 	}
 }