license-provenance: track decrypt-saved-deck-export MIT exception

[WilfordGrimley]

Summary

• docs/upstreaming/license-provenance.md §2 now tracks decrypt-saved-deck-export/decrypt.mjs (+ its test) as a second deliberately-MIT-licensed protected-core exception, mirroring the existing federation-hash-tool/hash_my_cards.py entry's pattern/phrasing exactly.
• Owner sign-off verified independently against the primary source: PR #242's own comment from WilfordGrimley (MEMBER), 2026-07-20, recording "go for the license, mirror federation-hash-tool, if we end up making any changes to it we can gpl them" — this resolves PR PR-6 deck portability: export/import + standalone decrypt tool #242's own "Deviations / open items" note Add NotMPC ordering tab and PringlePrints listing #1.
• Edited in place; no dated section appended.

Deviations / open items

1. check_protected_core_license.py's PROTECTED_CORE_FILES mechanical list NOT updated in this PR — decrypt-saved-deck-export/decrypt.mjs and its test only exist on PR PR-6 deck portability: export/import + standalone decrypt tool #242's branch (pr6-deck-portability-a1e108bb), not yet on master. Adding the paths to the CI script now produces a genuine, non-hypothetical red check (check_protected_core_license.py exits 2, "does not exist") since this branch doesn't have those files. Confirmed non-blocking either way — master has no branch protection (gh api .../branches/master/protection → 404) — but deliberately deferred rather than shipped red. Flagged in the doc itself (§2, new bullet) as a to-do for the PR that merges PR-6 deck portability: export/import + standalone decrypt tool #242, or immediately after.

Test plan

• python3 .github/scripts/check_protected_core_license.py — clean, 9 files checked (unchanged from before this PR — confirms this PR doesn't touch the mechanical list)
• python3 .github/scripts/tests/test_check_protected_core_license.py — 10/10 passing
• python3 .github/scripts/docs_lint.py — clean
• npx prettier@2.7.1 --check docs/upstreaming/license-provenance.md — clean
• pre-commit hooks (prettier, trim-trailing-whitespace, end-of-file-fixer) — passed