fix: isotree score convention — proper sklearn calibration
isotree decision_function returns [0,1] (higher=anomalous, 0.5=boundary).
The entire pipeline (normalize_scores, score_to_threat_level,
compute_adaptive_threshold) expects sklearn convention (negative=anomalous).
Previous fix (-raw_scores) negated all values, making everything
below -0.30 → all CRITICAL. New fix: 0.5 - isotree_score maps
correctly to sklearn's convention:
isotree 0.80 → -0.30 (CRITICAL)
isotree 0.65 → -0.15 (HIGH)
isotree 0.55 → -0.05 (MEDIUM)
isotree 0.50 → 0.00 (boundary)
Verified: 27,952 LEGITIMATE_BROWSER + 15,843 HIGH + 15,059 MEDIUM
Tests: 36/36 pass.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
c6666e2bba