Withdraw the self-test rule, which is the other half of the proof

The channel delivered in 30 seconds: the nonce path went from 404 to 403 at
the edge, a near-miss path stayed 404 so the rule had not over-matched, and
the site root stayed 200 so nothing else had changed.

Withdrawal is a first-class operation here precisely because a patch written
in the hours after a disclosure is written against an advisory and not against
traffic. An empty rulesets array withdraws everything the channel owns, and
this exercises that path while nothing depends on it - which is the only
comfortable time to find out whether it works.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N5fpE6Gu4W6JoFMXyb7t7r

cve.json

@@ -1,29 +1,4 @@
 {
-  "build_datetime": "2026-11-03T01:02:04Z",
+  "build_datetime": "2026-11-03T01:04:52Z",
-  "rulesets": [
+  "rulesets": []
-    {
-      "id": "edgeguard-cve",
-      "name": "EdgeGuard CVE Virtual Patches",
-      "version": "1",
-      "source": "edgeguard-cve",
-      "description": "Virtual patches for named vulnerabilities",
-      "enabled": true,
-      "priority": 1,
-      "rules": [
-        {
-          "id": "CHANNEL-SELFTEST-10503d3d40e334c7",
-          "name": "CVE channel self-test (temporary; withdraw after verifying)",
-          "pattern": "^\\/edgeguard-channel-selftest-10503d3d40e334c7$",
-          "targets": [
-            "uri"
-          ],
-          "action": "block",
-          "severity": "critical",
-          "category": "cve",
-          "enabled": true,
-          "description": "Proves this channel reaches an edge and is enforced. The path carries a random nonce, so no real client requests it and nothing legitimate can match. Withdrawn as soon as it is confirmed."
-        }
-      ]
-    }
-  ]
 }