fix: purgatory replacement announcements leaked into DB without git data

When a replacement 30617 announcement arrived for an entry already in
purgatory (e.g. the same event fetched from a second relay during sync,
or a user re-submitting a slightly updated announcement), the policy
returned Accept instead of AcceptPurgatory. This caused the event to be
saved to the database immediately, bypassing the purgatory gate, without
the corresponding git data or state events ever arriving.

Fix: return AcceptPurgatory when replacing a purgatory entry so the
updated event stays in purgatory until git data arrives. The purgatory
entry is still updated with the newer event via replace_purgatory_announcement
before the return.

1 files changed, 4 insertions, 2 deletions

diff --git a/src/nostr/policy/announcement.rs b/src/nostr/policy/announcement.rs
index aba5181..b474fbb 100644
--- a/src/nostr/policy/announcement.rs
+++ b/src/nostr/policy/announcement.rs
@@ -137,8 +137,10 @@ impl AnnouncementPolicy {
                                 "Replacement announcement (purgatory) - replacing purgatory entry"
                             );
                             self.replace_purgatory_announcement(event, &announcement);
-                            // Return Accept (not AcceptPurgatory) - this is a replacement, not new
-                            return validation_result;
+                            // Return AcceptPurgatory - git data hasn't arrived yet so the
+                            // announcement must NOT be saved to the database. The purgatory
+                            // entry has already been updated above with the newer event.
+                            return AnnouncementResult::AcceptPurgatory;
                         }
 
                         // No existing announcement - route to purgatory