Treat foundation.csv as a legacy, unreliable observation source

## Classification
Enhancement

## Context

The upstream `project-maintainers.csv` this codebase consumes is moving to
being *generated*; its git history will reflect generation runs rather than
human edits, so per-row CSV provenance loses meaning going forward.

## Scope

- Mark the source as legacy in code and UI (badge observations sourced from
it accordingly).
- Stop treating disagreement with this CSV as a signal worth surfacing.
- Define sunset criteria — the point at which `.project/maintainers.yaml`
coverage is sufficient to drop this source entirely.

Note: a per-run disable toggle for this enrichment/auto-add source already
shipped in PR #157, and was used (disabled) during that PR's UAT.

## Relationships

- Already partially scoped in a not-yet-filed "maintainer observation
history" redesign draft ("Foundation CSV becomes generated").
- Related to #153 (closed) — that issue was a rendering bug in the Foundation
CSV source label; this issue is the forward-looking policy/sunset work, not
a follow-on fix to that bug.

Start by tracing how project-maintainers.csv is consumed and how its source is shown in the UI, then review PR #157's per-run disable toggle and the maintainer observation history redesign draft. Define and document the .project/maintainers.yaml coverage threshold for sunset, mark the CSV as legacy, and stop surfacing disagreement with it when the criteria are met.

Written by the indexing model from the issue text.