legal: permanent do-not-contact for dataspindle.com + close re-import gap

David Sgro (PA OAG complaint BCP-26-05-025816) opted out 2026-04-13; response
emailed to the AG 2026-06-11. To make the suppression bulletproof and keep the
response's representations true:
- Added a legal do-not-contact list (DO_NOT_CONTACT_DOMAINS/_EMAILS) to
  _email_exclusions.py with dataspindle.com / dave@dataspindle.com; folded into
  BLOCKED_EMAIL_DOMAINS and is_blocked().
- listmonk_import.upsert_subscriber now refuses to import/re-confirm any
  suppressed address. This closes the exact gap that re-added him on 2026-04-26:
  the duplicate-import branch re-added an existing unsubscribed subscriber to
  lists with status=confirmed, overriding the opt-out.

docs/legal/AG-response-David-Sgro-SENT-NOTE.md

@@ -0,0 +1,20 @@
+# PA AG Complaint BCP-26-05-025816 (David Sgro / dataspindle.com) — Status
+
+- **Complaint filed:** 2026-04-13 by David Sgro (Quakertown, PA) with PA OAG
+  Bureau of Consumer Protection, agent Brett W. Mauser.
+- **AG mediation letter:** dated 2026-05-07, 21-day response window.
+- **Response sent:** emailed to the AG on 2026-06-11 (per Justin).
+
+## Suppression status (must remain true)
+- dave@dataspindle.com is `blocklisted` in the main listmonk (global, excluded
+  from all campaigns). Not present in the HC listmonk.
+- dataspindle.com + dave@dataspindle.com added to the legal do-not-contact list
+  in `scripts/_email_exclusions.py` (DO_NOT_CONTACT_DOMAINS / _EMAILS).
+- `listmonk_import.upsert_subscriber` now refuses to (re-)import or re-confirm
+  any suppressed/do-not-contact address — closes the duplicate-import gap that
+  re-added him to FCC lists on 2026-04-26.
+
+## Root-cause of the re-contact
+A duplicate import in `listmonk_import.py` re-added an existing (previously
+unsubscribed) subscriber to lists with status="confirmed", overriding the
+opt-out. Fixed by the do-not-contact gate above.