sanctions: state precisely which OFSI paths are dead, and which is merely undocumented

The earlier note said ConList answered 404. Measured across all three paths that
is only true for two of them: publishlive/ConList.{xml,csv} are 404, but the
legacy publishlive/2022format/ConList.csv still answers 200 and still carried a
Last Updated of 03/06/2026 — months after OFSI closed the list.

That distinction matters to anyone reading this file to decide a source. A live
blob the publisher has stopped documenting is worse than a dead one, because it
can stop at any time and nothing downstream would say so.

Co-authored-by: Hanzo Dev <[email protected]>

pkg/sanctions/lists.go

@@ -17,9 +17,18 @@ const euPublicToken = "dG9rZW4tMjAxNw"
 // once already. Verify against the publisher before editing a URL here:
 //
 //   - The UK source is the FCDO UK Sanctions List, NOT the OFSI Consolidated
-//     List. OFSI closed that list on 28 January 2026 and its ConList.xml has
-//     answered 404 since; from that date the UK Sanctions List is the only
-//     source for UK designations.
+//     List. OFSI closed that list on 28 January 2026, and from that date the UK
+//     Sanctions List is the only source gov.uk directs anyone to for UK
+//     designations.
+//
+//     Take care here, because "closed" and "unreachable" are not the same and
+//     the paths disagree. Measured 2026-07-29: publishlive/ConList.xml and
+//     publishlive/ConList.csv both answer 404, while the legacy
+//     publishlive/2022format/ConList.csv still answers 200 and still carried a
+//     Last Updated of 03/06/2026. A live legacy blob the publisher no longer
+//     documents is the worst of the options — it can stop without notice and
+//     nothing would report that, which is the failure this whole file is about.
+//     Use the documented source.
 //   - The EU file needs the token above. Requested without it the endpoint
 //     answers 403 rather than redirecting to an authenticated form.
 func DefaultLists() []types.SanctionsList {