Add decisions-based mailing list routing

The prompts used to arrive at this change since the previous commit

User said that in the future they will run scripts themselves when instructed, then asked to take the next step after the decisions.json mailing-list routing report and plan.

Any special observations that may be relevant for version management for this version. Be brief.

Added mailinglist_routes.json as the normalized runtime policy and wired mail_routes.py to use it before legacy domain routes. No mailbox-affecting scripts were run; validation was local only.

restart_prompt.md

@@ -161,7 +161,11 @@ That report interprets `decisions.json` as advisory intent:
 - `keuze: "a"` means route below `INBOX.Afmelden.*` for unsubscribe/review.
 - `keuze: "s"` is ambiguous and should be confirmed before automation.
 - Obvious aliases from the same sender or organization should be combined, including Coursera, MIT Technology Review, Eva Keiffenheim/Substack, PostNL, STRATO, Forte Labs, CIONET, Gusti, Nord, Proton, Vonage/Nexmo, and Visme.
-- The report is not active code yet; `verplaats_bestaand.py` still routes through `mail_routes.py`.
+- The normalized policy is now in `mailinglist_routes.json`; `mail_routes.py` loads it before falling back to legacy `DOMAIN_ROUTES`.
+- `mailinglist_routes.json` has 153 grouped rules and covers every key from `decisions.json` through `source_decision_keys`.
+- `destination_folders()` now includes functional keep folders plus `Afmelden.*` folders from `mailinglist_routes.json`.
+- Invoice keyword routing still takes precedence over mailing-list routing.
+- Do not run mailbox-affecting scripts yourself in this project. The user wants to run scripts personally when instructed.
 
 Key earlier findings:
 
@@ -174,6 +178,9 @@ Known remaining risk:
 
 - `kopieer_naar_backup.py` should be hardened so append failures cannot be silently marked as folder completion.
 - `verplaats_bestaand.py` should log failures with source folder, UID, destination, and server response.
+- Mailing-list routing currently supports domain and `From` substring policy matching. It does not yet fetch or match `List-ID` headers.
+- `circle8.nl` still has ambiguous decision value `s`; keep it as review/functional routing until the user confirms the meaning.
+- `alfen.com`, `vodafone.nl`, `dhlecommerce.nl`, and Proton splits are implemented according to `decisions.json` precedence, but remain notable policy changes compared with older hardcoded domain routes.
 
 ## What To Do Next