Procurement records show the hold tied to a Biden-era spyware policy was removed despite verified findings that Paragon’s Graphite infected journalists.