Mark Unreliable Rising Read

One-time, idempotent, NON-DESTRUCTIVE sweep over historical alerts.

The pre-#666 growth detector fired a fresh rising_kol alert daily off an unreliable avg-views sampling artifact (e.g. @barstoolsports 228K→3.7M ≈ 16×). #666/#667 added a reliability gate that HIDES those rows from the feed and the watchlist badge, but the rows are still is_read = False on disk, so the DB-wide unread count stays inflated (an empty feed but "13 unread"). The post-#666 detector no longer fires these, so the backlog is finite — this admin op marks the historical artifacts read so the unread count matches the feed.

Selection + gate (identical to what the feed/watchlist filter on):

• Scope: alert_type == "rising_kol" AND is_read == False across ALL workspaces/users (admin maintenance op).
• For each row, re-evaluate the SAME canonical gate the feed uses — watchlist_signals._rising_alert_is_reliable(payload) → views_reliability.is_views_delta_unreliable on the payload's avg_views_before / avg_views_after / follower_after. Missing keys / legacy shapes ⇒ treated reliable (NOT marked).
• Mark is_read = True ONLY for rows that are NOT reliable, i.e. provably-unreliable artifacts the feed already hides. We never mark a row read that the feed would still SHOW.

Guarantees: never deletes anything; never touches other alert types, reliable risers, or already-read rows; no schema change. Re-running is a no-op once the backlog is cleared (the second run scans the now-empty remaining unread set). dry_run=true commits nothing.