Address second review round on retention policy knowledge

- Scope both articles to bc-version [22..]: FindOrCreateRetentionPeriod
  first appears in the 21.1 System Application and OnRefreshAllowedTables
  in 22.
- Reframe the default-setup article as optional guidance; registration
  without a setup is valid. The anti-pattern and review routing now cover
  only false claims that registration alone cleans up data.
- Make all four samples self-contained: declare Contoso Activity Log in
  each, add the Retention Policy Setup permission, and guard the default
  setup on IsAllowedTable.
- Let evaluation overrides list additionalArticles and register both
  retention pairs as extra privacy cases (38 cases, existing IDs unchanged).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

evaluation/review-fixtures.json

@@ -23,7 +23,11 @@
       "article": "use-isempty-for-existence-check"
     },
     "privacy": {
-      "article": "no-pii-in-telemetry-message-string"
+      "article": "no-pii-in-telemetry-message-string",
+      "additionalArticles": [
+        "register-owned-log-tables-for-retention-policies",
+        "ship-a-default-retention-policy-setup"
+      ]
     },
     "style": {
       "article": "label-comment-explains-placeholders"