Add global lock and global block classification to account cohorts

[schiste]

Goal

Extend account-cohort reporting beyond local wiki blocks with two explicitly separate cross-wiki states:

• globally locked account;
• globally blocked account.

Do not label either state as a community ban.

Why this is separate

The account-creation metric can derive indefinitely active local blocks from each wiki public logging dump. Global locks and global blocks have different scope, actions, identity rules, and source ownership. They need an independently versioned source plan and metric contract rather than being inferred from local block logs.

Investigation

• Identify an authoritative, bulk-accessible and snapshot-pinnable source for Meta/CentralAuth globalauth lock, lockandhid, unlock and global block/unblock transitions.
• Confirm historical coverage, redaction behavior, stable central account identifiers, renames, temporary accounts, and source licensing.
• Determine whether metawiki logging dumps are complete enough or whether a separate Wikimedia dataset is required. Do not crawl the Action API as a substitute for a reproducible bulk source.

Implementation requirements

• Represent the global source as an immutable generation with a canonical source plan, source hashes, coverage cutoff, parser version, and strict receipt.
• Replay transitions through the selected snapshot cutoff and distinguish global lock from global block.
• Reconcile central identities to local permanent-account cohorts deterministically; exclude temporary accounts.
• Aggregate results only. Do not publish account-level lists or hidden identities.
• Track unmatched and redacted identities explicitly and fail closed when a matched latest transition cannot be classified.
• Keep this metric family independent so parser/source changes do not invalidate core history metrics or local-block results.
• Add fixtures for lock, lockandhid, unlock, global block, global unblock, rename, duplicate/out-of-order events, redaction, and snapshot rollover.
• Validate incremental and clean builds for semantic and byte equality.

Acceptance criteria

• Per creation cohort, report globally locked and globally blocked counts, each split by accounts with and without public edits.
• Current state is evaluated at the pinned snapshot cutoff, not at request time.
• Local indefinite blocks, global locks, global blocks, and community bans remain clearly distinct in schema and UI language.
• Provenance identifies the exact global source, cutoff, parser version, hashes, and limitations.
• Runtime memory and storage remain bounded for enwiki-sized identity sets.