Count the vzmobile known value, and report media absence as observed

[OneSixForensics]

Two follow-ups you raised on #452 after it merged. You said neither was worth a PR on its own, so they are together here.

1. The vzmobile known value could not fail

The generator asserts its declared known values against what it actually wrote, which is what makes the fixture worth trusting. actual["vzmobile"] was the literal 3 rather than a count, so it compared 3 against 3 and could never go red. The other seven keys are computed.

It now walks the VZMOBILE folder the way mms_media_files walks the attachment folders. Verified by declaring 4:

generator known values are stale, fix EXPECTED or the data: vzmobile: declared 4, emitted 3

exit 1, where before it printed and passed.

2. Link Status offered a cause the artifact cannot distinguish

was:  referenced — file not in daily folder; possibly quarantined/removed
now:  referenced — no file of this name in the MMS media folders

The notes explain that absence is expected for reported content, but the string is what lands in the examiner's column, and a file absent because it was quarantined and one absent for any other reason produce exactly the same observation. The cell now states what was checked; the notes carry the quarantine explanation, and now also say that absence alone does not establish why any one file is missing.

last_update_date bumped on both MMS artifacts, since the string is user-visible.

Verified

Only synchronoss_mms_received's baseline changes; the other nine are untouched.

• committed case 10/10 PASS
• real rleapp.py -t fs run reports the new string, with the same counts as the harness: uploads 11, sync 8, messages 12, calls 2, contacts 4, mms 6/1/1, quarantined 4, vzmobile 3
• pytest admin/test/scripts 205 passed plus 239 subtests
• pylint 10.00/10, lint_changed no new warnings, admin checkers clean

[github-actions]

Thanks for the contribution!

This PR changes artifact modules without test data for them. A small fixture with each artifact change lets reviewers run the module against real data, and the committed case keeps guarding the module after merge.

• synchronoss.py: please include a fixture with this PR.

Adding a fixture

Generate it from your extraction with the helper (details in create_module_test_cases.md):

python admin/test/scripts/make_test_data.py <module> --case <case_number> --input <extraction.zip>

It writes admin/test/cases/testdata.<module>.json and one zip per artifact under admin/test/cases/data/<module>/.

Size rules:

• Under 10 MB per zip: commit the files in this PR.
• 10 to 25 MB: commit the case JSON in the PR and attach the zip to a comment here.
• Over 25 MB: say so here and a maintainer will arrange a handoff.

If your extraction cannot be shared:

• If the app appears on a public research image, generate the fixture from that instead. public_corpus_images.md lists the images and where to download them.
• Or sanitize the real file in place: keep the file the app wrote and overwrite only the personal values, which keeps the format honest.
• Or script a known session: install the app on a test device with a throwaway account, perform documented actions, and extract that.

If none of those fit, say so here and we will work it out. The PR can still be reviewed and merged with the gap recorded in the artifact's notes.

This is a request, not a gate. Nothing here blocks review.