Stop applying country-scoped safety labels outside applicable_countries

[Pitchfork-and-Torch]

Bug

Tweet safety labels carry applicable_countries on the proto. SafetyLabelMap::from_proto_label_types keeps only the type key. Drop rules call has_safety_label, which is type presence only.

A Brazil-scoped DoNotAmplify or civic-integrity label therefore Drops a US viewer on TimelineHomeRecommendations. Geo-restricted media already reads the viewer country. Labels did not.

This is not expiry filtering (PR 106). Expired rows stay a separate class. Empty applicable_countries stays worldwide.

Fix

Keep per-type country lists on SafetyLabelMap. TweetPredicates::has_safety_label uses applies(label, viewer.country_code). Empty or missing scope is worldwide. A scoped label does not apply when the viewer country is missing or outside the list.

Proof

• Entry: SafetyLabel proto applicable_countries
• Sink: DoNotAmplifyOonDropRule / other tweet-label Drops via has_safety_label
• Break: from_proto_label_types discarded country scope
• Viewer effect: US For You dropped for a BR-only DNA/civic label
• Twin: DropTweetsWithGeoRestrictedMediaRule vs viewer country

Tests

• empty_countries_is_worldwide
• scoped_label_applies_only_in_listed_country (fails on unmodified main)
• country_scoped_do_not_amplify_allows_out_of_country_oon
• country_scoped_do_not_amplify_drops_in_country_oon
• unit tests added; cargo test cannot run in the public dump