“Uses suspicious framing like 'mystery' and 'strange hours' to imply illicit activity rather than reporting a simple regulatory violation.”