Validate images actually load (fix overcounted coverage)

A stored og:image isn't proof it renders: signed/hotlink-protected URLs (e.g.
the Guardian's i.guim.co.uk) 401 on a direct browser load, so they counted
toward coverage yet always fell back. Now fetch_og_image confirms the image
truly returns 200 + image/* (requested no-referrer, same SSRF-safe redirect
handling) before storing it. Add prune_broken_images() to clear already-stored
URLs that no longer load, so coverage is honest and those cards show the
placeholder cleanly. The browser onerror→placeholder remains the final safety net.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/test_enrich_images.py

@@ -47,6 +47,18 @@ def test_enrich_records_checked_even_when_none_found(tmp_path):
     assert again is False  # still within retry window
 
 
+def test_prune_clears_only_broken_images(tmp_path):
+    c = _setup(tmp_path)
+    _add(c, 1, image="http://good/a.jpg")
+    _add(c, 2, image="http://broken/b.jpg")
+    _add(c, 3, image=None)  # nothing to check
+    # Pretend only the 'good' host loads.
+    cleared = enrich.prune_broken_images(c, check=lambda u: "good" in u)
+    assert cleared == 1
+    assert c.execute("SELECT image_url FROM articles WHERE id=1").fetchone()[0] == "http://good/a.jpg"
+    assert c.execute("SELECT image_url FROM articles WHERE id=2").fetchone()[0] is None
+
+
 def test_backfill_only_targets_summarized_accepted_imageless(tmp_path):
     c = _setup(tmp_path)
     _add(c, 1, image=None, summarized=True, accepted=1)   # eligible