fix(gui): show the connections "impaired?" column as a session-long record

[donislawdev]

What & why

Targeting a process (e.g. chrome.exe) showed a connections table where the large
majority of rows read "no" in the impaired? column, so the tool looked like it was
missing most of the traffic. It was not — the column was misreporting finished
connections.

The column was recomputed live (conns.py::_render → engine.in_scope_now →
core.in_scope → local_port in target_ports). A closed or idle flow's ephemeral port
has left the socket table, so the live test returns False for every connection that is no
longer open — which is most of them on a browser. A run that impaired all of Chrome
therefore rendered as a table full of "no".

The fix

• engine._log_conn keeps the per-flow scoped flag sticky
  (c["scoped"] = c["scoped"] or bool(scoped)) — a session-long "was ever in impairment
  scope" record.
• conns.py::_render reads that stored flag instead of the live lookup.
• The live "in scope now" signal is unchanged: it is the row highlight (_tag_of,
  still via in_scope), so narrowing chrome→firefox drops the highlight without erasing the
  record.

Two-signal design: the column is the audit trail (sticky); the row highlight is the
current target (live).

Coherence bug also fixed

The on-screen cell was live, while the column's sort key (views.py) and the CSV
export (gui/app.py) already read the stored flag — three call sites, two semantics.
All three now read the one sticky flag, so the table, its sort order and the export agree.

Tests

• new tests/test_engine.py::test_scoped_is_a_sticky_session_record — three packets on
  one flow (in scope, then twice out) keep the flag True; a never-scoped flow stays
  False. Driven straight through _log_conn, no thread timing.
• rewrote tests/test_conns_columns.py::test_connection_columns_tag_and_footer — an
  out-of-current-target row now asserts column "yes" (stored record) with no highlight
  tag (live), locking the two-signal split.
• tests/test_conns_export.py and test_engine.py::test_connection_records_scope_and_dropped
  were already consistent with the stored flag and pass unchanged.
• Full suite green.

Scope

This is Chunk 1 of 2 (display truth). The underlying port→PID resolution is still a
periodic socket-table snapshot, so short-lived connections that open and close inside a
refresh window can still escape impairment (tests/test_target_resolver.py documents the
race). Closing that at the source with the WinDivert FLOW/SOCKET layer is Chunk 2,
tracked separately.

🤖 Generated with Claude Code