Address review feedback on retention policy knowledge

- Scope both articles to bc-version [17..] (retention policies shipped in v17).
- Allowed-tables sample: add OnRefreshAllowedTables subscriber with a
  ForceUpdate path; the upgrade tag now gates one-time setup only.
- Default-policy sample: use Retention Policy Setup.FindOrCreateRetentionPeriod
  instead of a hand-rolled lookup-then-insert that can collide on code.
- Anti-pattern now keys on append-only tables rather than table names.
- al-privacy-review: add retention-policy tokens and deterministic routing
  for both articles, with a bounded per-table text search for delete and
  registration paths.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

microsoft/knowledge/privacy/register-owned-log-tables-for-retention-policies.good.al

@@ -3,12 +3,21 @@ codeunit 50560 "Contoso Reten. Pol. Setup"
     Access = Internal;
 
     procedure AddAllowedTables()
+    begin
+        AddAllowedTables(false);
+    end;
+
+    // ForceUpdate re-registers even after the upgrade tag is set, so the
+    // table comes back when an administrator refreshes the allowed tables.
+    procedure AddAllowedTables(ForceUpdate: Boolean)
     var
         ContosoActivityLog: Record "Contoso Activity Log";
         RetenPolAllowedTables: Codeunit "Reten. Pol. Allowed Tables";
         UpgradeTag: Codeunit "Upgrade Tag";
+        IsInitialSetup: Boolean;
     begin
-        if UpgradeTag.HasUpgradeTag(AllowedTableTag()) then
+        IsInitialSetup := not UpgradeTag.HasUpgradeTag(AllowedTableTag());
+        if not (IsInitialSetup or ForceUpdate) then
             exit;
 
         if not RetenPolAllowedTables.IsAllowedTable(Database::"Contoso Activity Log") then
@@ -17,13 +26,20 @@ codeunit 50560 "Contoso Reten. Pol. Setup"
                 ContosoActivityLog.FieldNo(SystemCreatedAt),
                 28); // support cases need at least four weeks of log history
 
-        UpgradeTag.SetUpgradeTag(AllowedTableTag());
+        if IsInitialSetup then
+            UpgradeTag.SetUpgradeTag(AllowedTableTag());
     end;
 
     local procedure AllowedTableTag(): Code[250]
     begin
         exit('Contoso-ActivityLogAllowedTable-20260910');
     end;
+
+    [EventSubscriber(ObjectType::Codeunit, Codeunit::"Reten. Pol. Allowed Tables", OnRefreshAllowedTables, '', false, false)]
+    local procedure AddAllowedTablesOnRefreshAllowedTables()
+    begin
+        AddAllowedTables(true);
+    end;
 }
 
 codeunit 50561 "Contoso Reten. Pol. Install"