diff-logs: ignore OCSF Network Activity Refuse (policy DNS) records that have no port #69

When policy DNS refuses a name the active policy does not allow, OpenShell logs a Network Activity record with class_uid 4001, activity_id 5 ("Refuse") and status_detail: policy_dns_ineligible. That record has no port and no actor. This happens in v0.1.6 and v0.1.7 (openshell-supervisor-network/src/policy_dns/mod.rs). Real v0.1.7 record:

{"class_uid":4001,"activity_id":5,"activity_name":"Refuse","status_detail":"policy_dns_ineligible","dst_endpoint":{"domain":"example.com"},"action_id":2,"action":"Denied","disposition":"Blocked"}

The connection attempt that follows is logged separately as a 4001 Open/Denied record with the host, port and binary.

diff-logs on OCSF JSON counts the Refuse record as a second denial. It then adds a bogus "manual review: example.com:? (denied connection without a port)" item for each refused host. The run reports 5 denied events, while the same run's shorthand (NET:REFUSE lines are not matched) reports 3.

Fix: skip 4001 records with activity_id 5 or status_detail == "policy_dns_ineligible" in parse_json_line.