Record deferred upstream Mike classifications

[github-actions]

Automated-Upstream-Mike-Sync: true
Upstream-Risk: none

No upstream item can be safely adapted as a complete, bounded, adequately testable batch against current ROSS main. The unified patch is empty.

Classified upstream items

• Mike PR feat: add folder-grouped tabular review rows Open-Legal-Products/mike#274: defer — High-risk schema, migration, RLS, and production-data-boundary change. Its 32-file patch also exceeds the 30-file batch limit by itself; a partial adaptation would be incomplete.
• Mike PR [Security 5/9] Nonce-based spotlighting of untrusted content in prompts Open-Legal-Products/mike#248: defer — High-risk prompt-security and cryptographic nonce boundary change. ROSS chat internals diverge, and the supplied Vitest coverage is not runnable in the current backend harness.
• Mike PR Self-hosted Docker stack (embedded Supabase + storage + email) and local Ollama models (supersedes #196) Open-Legal-Products/mike#282: defer — High-risk deployment, infrastructure, authentication, storage, provider-credential, and Supabase boundary change with a broad cross-stack blast radius.
• Mike PR Confirm destructive folder deletes in chat explorer Open-Legal-Products/mike#174: defer — The assistant explorer still lacks confirmation, but the upstream implementation diverges from ROSS UI components and depends on an unavailable frontend test harness, making a safe complete adaptation insufficiently testable.
• Mike PR fix: validate project chat request bodies before side effects Open-Legal-Products/mike#283: defer — Medium-risk request-validation hardening. ROSS already has divergent global-chat and legal-scope validation, while project-chat validation remains separate; the upstream shared refactor and Vitest integration tests cannot be adopted and validated without speculative changes.
• Mike PR Default local signup to autoconfirm and streamline setup docs Open-Legal-Products/mike#287: defer — High-risk authentication and deployment-default change that depends on the unapplied self-hosted Docker stack. Its documentation also describes infrastructure absent from ROSS.
• Mike PR docs: simplify Docker quick start Open-Legal-Products/mike#289: defer — Obsolete for current ROSS because the documentation assumes the deferred Docker, embedded Supabase, storage, and Ollama stack from PR Self-hosted Docker stack (embedded Supabase + storage + email) and local Ollama models (supersedes #196) Open-Legal-Products/mike#282.
• Mike PR [Security 6/9] Server-side citation verification against source text Open-Legal-Products/mike#249: defer — High-risk server-side citation trust-boundary change. ROSS has materially divergent citation and legal-source verification architecture, and the supplied backend/frontend tests do not match its available test harnesses.

State-only classification

No safe code adaptation was applied. This PR records deferred classifications so the queue can continue without reconsidering the same items.