Calibrate whole-surface migration effort

[laclance]

Summary

Fix effort underestimation for broad interface migrations such as aws/amazon-vpc-cni-k8s#3906.

The issue asks to migrate iptables handling to the nftables API for all rules, with Prerouting already migrated and remaining Postrouting/mangle paths still using iptables-nft. The existing estimator classified it as 6–12h solely from the enhancement signal.

This adds a narrow large-effort signal for explicit whole-surface migrations: migration/replacement/conversion language combined with all, every, or remaining rules/paths/calls/uses.

Regression coverage

• AWS VPC CNI #3906-shaped input estimates 1d+
• reason is whole-surface interface migration
• a one-rule API migration remains 6–12h

Scope

Only:

• opportunity_scout/scoring.py
• tests/test_effort_preferences.py

No readiness changes, private-instance changes, or release changes.