Mark device-flag confidence honestly (SAI confirmed, O2 probable)

The NO-SAI-NO-O2 reference map bundles SAI + O2 + airbox deletes, so it validates
the three flag bytes as a GROUP but doesn't isolate O2 individually; no single-mod
map exists and the x.a() device-layout branch for this ECU is too nested to trace.

- SAI @ 0x53801: confirmed (code lc() -> Devices[0] via fe[33], + the delete map).
- O2 @ 0x53818/0x53819: probable (2 O2 sensors declared off <-> 2 adjacent bytes
  cleared; 865 has no air-flap so airbox removal is fuel-only).

Viewer now shows confirmed/probable badges and a warning that flags alone are not
a tune: O2 delete forces open-loop and needs fuel enrichment, so prefer flashing a
complete matching delete map over hand-toggling a stock one. See DEVICES.md.

tunie/viewer/build_viewer.py

@@ -103,9 +103,9 @@ def _extract_romdefs(args) -> dict:
         # Validated against a NO-SAI-NO-O2 reference map (see research DEVICES.md).
         "deviceFe": 33,
         "devices": [
-            {"name": "SAI (Secondary Air Injection)", "rel": 0x00},
-            {"name": "O2 sensor", "rel": 0x17},
-            {"name": "O2 sensor (2)", "rel": 0x18},
+            {"name": "SAI (Secondary Air Injection)", "rel": 0x00, "confidence": "confirmed"},
+            {"name": "O2 sensor 1", "rel": 0x17, "confidence": "probable"},
+            {"name": "O2 sensor 2", "rel": 0x18, "confidence": "probable"},
         ],
     }