Driver-declared exceptions should use paired provenance and fail closed

When adding a new driver-selected exception to a shared verification flow, keep one registry for the user label, reviewer label, reason, and source. Derive both UI paths and audit parsing from that registry. At the persistence boundary, require the boolean marker, reason, source, and timestamp to form a valid matched tuple; incomplete or mismatched evidence should follow the original failure path. This preserves truthful choices and backward compatibility without turning an upstream equipment label into a legal or policy decision.