Shadow mode: a later 2xx write with no known record isn't counted as unexplained in the FHIR recheck #1684

From review round 4 of #1678 (non-blocking).

Shadow._unexplained_later (packages/flow/openadapt_flow/shadow.py) decides when a FHIR recheck's REFUTED rests on a later write that the shadow can't attribute, and should therefore be UNCERTAIN. It counts only later writes whose status isn't 2xx. A later 2xx write whose record the shadow can't name is not counted:

• a create with Prefer: return=minimal and no Location;
• a transaction Bundle POST to the base URL;
• a conditional PUT Patient?identifier=....

Such a write can still land inside an earlier CONFIRMED's recheck window. The recheck then refutes, blaming the agent for a change that may have been its own declared write. The effect is a false REFUTED, never a false CONFIRMED.

Fix: also count later writes with w.status // 100 == 2 and not o.refs, and add a test with a 2xx reply that carries no id or Location.