fix(corewlan): detect redaction from the data, not the status

[krisarmstrong]

Why

DecodeScan trusted the authorization status. That is not sufficient, and the failure is silent.

CoreWLAN redacts according to the calling process's own client identity. A bundled executable launched directly — rather than through LaunchServices — is a different CoreWLAN client from its bundle. So the manager can truthfully report that the bundle holds the grant, while the scan it hands back is stripped.

Observed on macOS 27.0 running Trellis's capture binary directly out of its signed, entitled, authorized bundle:

$ plutil -p /var/db/locationd/clients.plist | grep -A5 trellis.capture
"BundleId" => "net.mustardseed.trellis.capture"
"Authorized" => true

$ ./Trellis Capture.app/Contents/MacOS/trellis-capture
[{"ssid":"","bssid":"","signal":-47,"channel":40,"frequency":5200,"security":"WPA3",...},
 {"ssid":"","bssid":"","signal":-75,"channel":11,"frequency":2462,"security":"WPA3",...},
 ...13 networks, not one identifier among them]

No error. Correct RSSI, correct channels, correct security — and nothing nameable. For a survey product that is worse than a failure: it records a walk of nameless BSSIDs that looks exactly like data.

Fix

DecodeScan also returns ErrLocationDenied when a scan found networks and named none of them. A real observation always carries a BSSID, so that state is unambiguous.

An empty airspace stays a successful empty scan — there is nothing to strip, so len == 0 is not redaction.

Tests

Two added:

• authorized status, every identifier stripped → ErrLocationDenied
• authorized status, zero networks → success, empty

gofmt · go vet · golangci-lint 0 issues · go test -race · darwin and linux build.

Consumers

Both seed and trellis get this for free on the next bump; neither needs a code change. Seed's helper is launched by launchd from a plist that names the inner binary, which is exactly the shape that can hit this.