feat(rewrite): revisit HIGH sensitivity classification and any_high_leaked trigger for needs_human_review

Background

needs_human_review is triggered by two conditions: leakage_mass > flag_leakage_mass_above (default 2.0) or any_high_leaked=True. Investigation of TAB runs showed all flagged rows were triggered by any_high_leaked, not leakage mass.

The entities flagged as HIGH sensitivity were:

• court_name (e.g. 'District Court', 'Budapest District Court') — fixed by PR #94 domain supplements
• legal_role (e.g. 'defendant_in_recovery_action')
• former_senator (occupation type)

These are quasi-identifiers at most. Flagging them as HIGH causes needs_human_review=True even when leakage mass is low and utility is good (e.g. utility=0.97, leakage=0.96).

Questions to resolve

• What is the right criteria for HIGH vs. MEDIUM sensitivity? Should quasi-identifrs ever be HIGH?
• Should any_high_leaked alone be sufficient to trigger needs_human_review, or should it require a minimum leakage mass too?
• Should sensitivity level be configurable per domain (e.g. LEGAL may have different thresholds than MEDICAL)?

Related

• PR #94 partially addressed this for court_name via LEGAL domain supplements
• Ties into the domain-specific risk tolerance work removed before release (see domain supplement follow-up issue)

Review the implementation of sensitivity classification and the needs_human_review trigger, then compare it with PR #94 and the domain supplement follow-up issue. Resolve the HIGH versus MEDIUM criteria, the role of any_high_leaked, and whether domain-specific thresholds are needed. Done means the policy is agreed and reflected in the relevant behavior and validation.