docs: separate strict_mode from BLOCK policy in compliance docs

[yuee3]

What

Separate strict_mode from opt-in BLOCK policies in the configuration and compliance docs. Documentation accuracy only — do not change strict_mode behavior.

1. docs/compliance/owasp-asi06.md — replace "In strict_mode, unverified context is rejected entirely." with wording that says unverified context is flagged (MISSING / INCOMPLETE) and still logged; rejecting it requires an opt-in BLOCK-level policy; strict_mode only re-raises internal governance exceptions such as storage failures.
2. docs/guide/configuration.md — rewrite ### strict_mode so it no longer lists "provenance validation failures" as something strict_mode turns into exceptions, and soften the tip that implied strict_mode is what blocks the agent workflow for bad provenance.
3. docs/compliance/eu-ai-act.md — fix the Article 9 sample comment (strict_mode=True, # Governance failures raise exceptions) so it no longer implies VALID / INCOMPLETE / MISSING verdicts raise under strict_mode.

Why

Closes #200. In ContextTrail.log / _log_internal:

1. Provenance and freshness are computed and written onto the record.
2. The record is appended to storage (or the buffer).
3. _enforce_policies may raise PolicyViolation only when a configured policy uses EnforcementLevel.BLOCK.
4. PolicyViolation is re-raised immediately and never goes through _handle_error.
5. _handle_error (used for other exceptions) increments the error count, calls on_error, and only if strict_mode re-raises that exception.

So MISSING/STALE records still persist under strict_mode=True with no BLOCK policy. Confusing the two leads operators to believe they have a reject-on-missing gate when they only have observe-and-flag behavior.

Related to #199 but not a duplicate — #199 covers the LLM-gate framing; this one is specifically the strict_mode vs policy BLOCK confusion in the configuration and compliance pages.

How checked

• Read src/provena/trail.py (_handle_error, log / _log_internal, _enforce_policies) and src/provena/policy.py (EnforcementLevel.BLOCK, PolicyViolation).
• Matched every "What to do" item in Docs incorrectly claim strict_mode rejects MISSING or unverified provenance #200 to a concrete edit.
• Documentation-only. strict_mode behavior unchanged.

Scope

• docs/guide/configuration.md (### strict_mode)
• docs/compliance/owasp-asi06.md ("How Provena Addresses ASI06")
• docs/compliance/eu-ai-act.md (Article 9 strict_mode sample comment)