docs(compliance): record dated provenance for evasion-stack keep decision

AGENTS.md and SECURITY.md previously attributed keeping the WAF-bypass/
Tor/FlareSolverr/curl_cffi/cloudscraper stack to an unattributed,
unverified "medvetet användarbeslut" (deliberate user decision) with no
stated author or date -- flagged by a prior audit as unverified provenance.

Replace with an accurate, dated statement: the account owner (Simon
Axelsson) was asked directly via an interactive decision prompt on
2026-08-11, in direct response to a compliance audit's removal proposal
(the surgically-clean removal PR #7, verified 128/128 tests, was closed
unmerged), and explicitly chose to keep the code. No business or legal
rationale beyond "keep it" was given or is invented here.

This is a narrow, scoped exception for the existing 0PT/0pt-motor sourcing
engine. CLAUDE.md §1's general anti-evasion policy text is untouched and
remains in force as written unless/until the account owner says otherwise.

No code changes -- documentation only.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

AGENTS.md

@@ -19,8 +19,15 @@ entity-resolution, provenance per fält, adaptive router, orderflöde med
 ## Viktiga förhållanden
 
 - **Bypass-stacken** (`services/scrapers/*`, `waf_bypass.py`, data-stack-compose,
-  `adaptive_router.py`) är **medvetet behållen per användarbeslut** — rör den inte,
-  och nämn alltid "medvetet användarbeslut" om den dyker upp i compliance-rapporter.
+  `adaptive_router.py`) är **behållen** — rör den inte. Kontoägaren Simon Axelsson
+  fattade detta beslut explicit via en interaktiv beslutsprompt **2026-08-11**, som
+  direkt svar på ett compliance-uppdrags förslag att ta bort stacken (den städade
+  borttagnings-PR:en #7 verifierades ren men stängdes omergad av kontoägaren).
+  Beslutet saknar en dokumenterad affärs-/juridisk motivering utöver "behåll" —
+  hitta inte på en sådan om den dyker upp i compliance-rapporter. Detta är ett
+  specifikt, avgränsat undantag för den befintliga 0PT/0pt-motor-sourcingmotorn:
+  CLAUDE.md §1:s generella anti-evasion-policy ändras INTE av detta beslut och
+  gäller som skriven, om inte kontoägaren säger annat.
 - **Auth:** `/api/0pt/*` fail-closed i kod (Zitadel via middleware), men live-instansen
   svarade 2026-08-10 anonymt 200 (lucka S1 — rotorsaksanalys ej klar). Påstå aldrig
   att produktionen är skyddad innan en anonym request fått 401.

SECURITY.md

@@ -77,8 +77,16 @@ rather than surfacing something new:
   (`waf_bypass.py`: FlareSolverr, Tor, cloudscraper, curl_cffi, proxy rotation,
   fake identities) and `services/infra/docker-compose.data-stack.yml`
   (flaresolverr/tor containers) contradict this repo's own compliance docs.
-  They are retained **as an explicit user decision** (2026-08-10) and are out of
-  scope for deletion — see `docs/compliance/GOLDEN-STANDARD-REPORT.md` control C6.
+  A cleanup PR that surgically removed this stack (PR #7, verified clean, 128/128
+  tests) was closed unmerged by the account owner. **The account owner, Simon
+  Axelsson, was asked directly via an interactive decision prompt on 2026-08-11
+  whether to keep or remove this code, and explicitly chose to keep it.** No
+  business or legal justification beyond "keep it" was recorded — none is
+  invented here. This is a narrow, scoped exception for the existing 0PT/0pt-motor
+  sourcing engine; it does not change `CLAUDE.md` §1's general anti-evasion policy,
+  which remains in force as written unless/until the account owner says otherwise.
+  Out of scope for deletion — see `docs/compliance/GOLDEN-STANDARD-REPORT.md`
+  control C6.
 - Beyond those items, other authentication gaps on internal API routes may still
   exist and are tracked internally pending an intentional, reviewed fix; reporting
   any you find is still welcome and helps confirm priority.