Sentinel AEGIS v3.9.5 — Network Trust Gate

- Added a distinct Network Trust Gate after the existing security decision.
- Trusted traffic retains the user CAPTCHA ON/OFF behavior.
- DCH/hosting, VPN, proxy and other step-up networks receive a mandatory hard challenge.
- Hard challenge is independent of the user CAPTCHA preference.
- Hard challenge combines the existing server nonce/session binding and proof-of-work with a deliberate press-and-hold interaction.
- Failed hard challenges feed the existing persistent reputation/failure penalty system.
- Existing confirmed TOR, botnet, bogon and explicit automation blocks remain unchanged.
- No alternate destination/cloaking behavior was added.