Add terminate-only STIR/SHAKEN option across RMD pipeline

STIRShakenStep intake:
- New "Terminate only" option for carriers that only receive pre-signed
  calls and don't originate
- Contextual hints for each option explaining requirements
- Show/hide vendor and upstream fields based on selection

RMD letter generator:
- New terminate_only section explaining verification-only posture,
  citing 47 CFR § 64.6301 (signing obligation on originating provider)
- Added to needs_exhibit_a list

RMD Exhibit A generator:
- New terminate_only STIR/SHAKEN paragraph with SBC verification language
- Fixed scope paragraph: wholesale/facilities carriers no longer get
  "small provider without Class 4 switch" boilerplate
- Fixed OCN paragraph: wholesale carriers get neutral wording instead
  of "no OCN required for small retail provider"

RMD filing handler:
- Maps stir_shaken_status to rmd_option for Exhibit A generation
- Passes entity metadata (ocn, wholesale, gateway, contact) to generator
- Maps terminate_only → partial_implementation for FCC RMD form radio

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

scripts/document_gen/templates/rmd_letter_generator.py

@@ -463,6 +463,7 @@ def generate_rmd_letter(
 
     needs_exhibit_a = stir_shaken_status in (
         "partial_implementation",
+        "terminate_only",
         "robocall_mitigation_only",
         "exempt_small_carrier",
     )
@@ -1071,6 +1072,24 @@ def _build_stir_shaken_section(
                 italic=True,
             )
 
+    elif stir_shaken_status == "terminate_only":
+        b.body(
+            f"{entity_name} operates exclusively as a terminating provider "
+            f"and does not originate calls onto the public switched telephone "
+            f"network. {entity_name} receives pre-authenticated traffic from "
+            f"originating and intermediate providers and verifies STIR/SHAKEN "
+            f"attestation information on all inbound SIP INVITE messages."
+        )
+        b.body(
+            f"As a terminating-only carrier, {entity_name} is not required to "
+            f"maintain its own STI certificate or SPC token for call signing. "
+            f"Per FCC rules (47 CFR § 64.6301), the obligation to sign calls "
+            f"falls on the originating provider, not the terminating provider. "
+            f"{entity_name} certifies partial STIR/SHAKEN implementation "
+            f"(reflecting its verification-only posture) and has implemented "
+            f"a robocall mitigation program as described in Exhibit A."
+        )
+
     elif stir_shaken_status == "robocall_mitigation_only":
         b.body(
             f"{entity_name} has not implemented STIR/SHAKEN caller ID "