Confirm a quarantined message as a threat

Marks the item confirmed_threat for arena sideband analysis. Does not write to sh_threat_patterns — the quarantine store holds only a content hash, and the pattern table requires plaintext.