feat(scout): automate Kdo Cy via Prospective API; close SBB and Kdo Cy

Scout
- New `prospective` adapter for ohws.prospective.ch, wired up as `kdocy`
  (jobs.admin.ch, filtered to Kommando Cyber). jobs.admin.ch is an S3-hosted
  SPA that returns AccessDenied to any direct fetch, headless included, so the
  site cannot be scraped -- but the SPA reads a public, unauthenticated API.
  All 463 federal roles in ~2.4s, against RUAG's 35s Playwright scrape.
- This board is richer than any other source: Lohnklasse, application deadline,
  a named contact per posting, and the full Aufgaben/Anforderungen body, so
  scoring runs against the JD text rather than the title.
- Thread `deadline` through normalization, the markdown report and the JSON
  dump. A board with hard deadlines needs them on the row.
- Match `verwaltungseinheit_*` by prefix: the sub-unit key is department
  specific (VBS 1083398, EFD 1083364) and hardcoding one breaks reuse.
- MANUAL_CHECK entry for the Bundeswehr Reserve portal. The data is reachable
  (SAP E-Recruiting OData, SearchCategory 0022) but the portal actively blocks
  automation, and getting through needs UA spoofing plus masking
  navigator.webdriver. Not wired up by choice -- the operator-sanctioned
  Suchauftrag/job alert is the better channel. Reasoning is in the comment.

Applications
- SBB Data Engineer 103755: interviewed 2026-09-09, WITHDRAWN by the candidate
  2026-09-11. Net downgrade on four axes (41h vs 40h, 25+Brueckentage vs 28+5,
  3 vs 2 office days, and Anforderungsniveau K tops out ~145k against ~135k
  inside a band running to ~160k -- he would enter K at its ceiling merely to
  break even). The cohort's only interview, and it ended as his no, not theirs.
- Kdo Cy DevOps Engineer III: REJECTED 2026-09-10, 14 days, no interview.
  Form letter with no diagnostic content. Identical on every recorded
  dimension to SBB (core / 79 / gate pass / DQ 92 / weak channel) and the two
  went opposite ways -- recorded as worth watching, not as evidence for the
  channel thesis.
- Citadel row cleaned up: it claimed the cohort and decision-log entries were
  deliberately unwritten while its own status line read SUBMITTED. Both exist.
  The next-step cell still said "ask BEFORE building the package" two weeks
  after submission.

Decision log
- 69 RUAG rows -> 3 undecided. 63 title/family rule-outs, each noting that it
  is not a JD read, plus three that are: Test Manager C5I, System Engineer C5I,
  ICT Solution Architect. Guarded against the shared F/A-18 slug so one write
  could not silently swallow the other.

Note: the K->L/Kader rule is SBB-specific and was deliberately narrowed --
Anforderungsniveau is SBB's own system and does not map onto jobs.admin.ch
(Lohnklassen), RUAG or PostFinance. Thun-area employers sit outside the Bern
salary logic entirely.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Qej5SBvhcbGXHwLqNWiskM

job_scout/state/application_cohort.json

@@ -44,7 +44,7 @@
       "evidence_fit": 79.0,
       "hard_gate": "pass",
       "channel": "weak",
-      "outcome": "interview_invited",
+      "outcome": "withdrawn_by_candidate",
       "submitted": "2026-08-25",
       "open_risk": "Anforderungsniveau K is a capped GAV band, figures not public; seat may read lateral or below current Staff + Component Owner scope.",
       "interview": {
@@ -52,9 +52,16 @@
         "invited": "2026-08-28",
         "scheduled": "2026-09-09 08:30",
         "duration_min": 45,
-        "format": "Microsoft Teams"
+        "format": "Microsoft Teams",
+        "held": "2026-09-09",
+        "result": "Held 2026-09-09 (HR + Scrum Master). Candidate WITHDREW 2026-09-11 after SBB confirmed there was no room to move on the Einstufung.",
+        "user_read": "User reported 'ein paar Red Flags' and judged that the Rahmenbedingungen do not compensate for them. The specific red flags were NOT captured while fresh - if this is reopened, ask before relying on memory. Leaning negative but explicitly undecided as of 2026-09-10; he asked to leave it open pending SBB's feedback."
       },
-      "note": "FIRST interview invitation in the evidence-first cohort. Converted from a COLD submit - the published warm contact (Andri Wienandts, +41 79 364 62 53) was never called. The resume never contained Snowflake, dbt or Power BI, the three literals an ATS keyword screen would have keyed on, so a human read the dossier."
+      "note": "FIRST interview invitation in the evidence-first cohort. Converted from a COLD submit - the published warm contact (Andri Wienandts, +41 79 364 62 53) was never called. The resume never contained Snowflake, dbt or Power BI, the three literals an ATS keyword screen would have keyed on, so a human read the dossier.",
+      "comp_datapoint": "HARD FIGURES, from the interview - supersedes the earlier +10% estimate. Anforderungsniveau K TOPS OUT AT ~CHF 145k. His own position: ~CHF 135k today inside a Swisscom band that runs to ~CHF 160k. So the decisive point was NOT the absolute number but the HEADROOM: he would have had to enter K at its ceiling just to break even, with nothing left above. First hard calibration of a Swiss public-sector band and the reference point for the whole Bern/Thun tier (RUAG, Swissgrid, BKW, BFH, PostFinance).",
+      "withdrawn": "2026-09-11",
+      "why_withdrawn": "Total package was a net DOWNGRADE on four counts: 41h vs 40h week; 25 days holiday + Brueckentage vs 28 + 5 from Zeitautonomie; 3 office days vs 2; and the band ceiling above. Plus a qualitative red flag: he spoke only to HR and the Scrum Master and perceived DIFFICULTIES IN THE TEAM. That one is not fixable by a salary offer - note it if SBB or a similar Bern-tier seat comes back.",
+      "lesson": "SBB-SPECIFIC targeting rule (user 2026-09-11): at SBB, Anforderungsniveau K is too low - aim at Niveau L and/or Kader. NARROWED the same day at the user's instruction: Anforderungsniveau is SBB's OWN system (https://company.sbb.ch/de/jobs-karriere/arbeitgeberin/lohn.html) and does NOT generalise - jobs.admin.ch uses Lohnklassen, RUAG its own scheme, PostFinance per-posting bands. ~145k is an SBB ceiling, not a tier anchor. THUN-AREA EMPLOYERS (RUAG, Kdo Cy) ARE EXPLICITLY OUT of this reasoning: near-zero commute plus benefits a band does not show - he named childcare-cost coverage at the Schweizer Armee/Kdo Cy as potentially far more generous (UNVERIFIED - ask). Never decline a Thun-area role on band alone. What DOES generalise: judge by headroom in the band, and price the total package (working time, holiday, office days), not the entry number."
     },
     {
       "company": "Citadel Securities",
@@ -74,7 +81,11 @@
       "evidence_fit": 79.0,
       "hard_gate": "pass",
       "channel": "weak",
-      "outcome": "applied"
+      "outcome": "rejected_no_interview",
+      "submitted": "2026-08-27",
+      "rejection_date": "2026-09-10",
+      "days_to_disposition": 14,
+      "note": "Form-letter rejection from Besarta Mehmeti, no interview, 14 days to disposition - the fastest in the log after Google Business Home. The letter is boilerplate ('Profil und unsere Kriterien nicht in allen Punkten uebereinstimmen') and carries ZERO diagnostic content, so it is not a signal about the package and is no reason to re-audit it. Same disposition class as Microsoft ISE, Google Business Home and Aker BP: a cold-channel no-interview rejection does not implicate document quality on its own. WORTH WATCHING, NOT CONCLUDING: this row and the SBB row are identical on every recorded dimension - core, Evidence Fit 79, hard gate pass, Document Quality 92, channel weak - and they went opposite ways (SBB converted to an interview, this died in 14 days). That shows the fit score did not discriminate; it does NOT show what did. n=1 on each side. Do not react with positioning changes (application_strategy.md 38/74). Channel note: Marcel Matthey-Doret (+41 58 46 78409) was published and never called - the fourth published, reachable contact left unused after Heinzen (RUAG), Wienandts (SBB) and Marthinsen (Aker BP). Consistent with the 2026-09-05 channel policy, but NOT evidence for it: the single interview in this log came from a cold submit."
     },
     {
       "company": "RUAG MRO Holding AG (Business Area C5I)",