fix(api): hide campaign operational internals

README.md

@@ -33,6 +33,14 @@ Files and mail are optional module integrations declared in the campaign manifes
 - `govoplan-files` enables managed attachment selection, frozen file-version evidence, and managed-file usage tracking. Server/API campaigns require this integration for attachments and never resolve caller-supplied local filesystem paths. Legacy file-oriented loading remains available only to explicitly trusted operator/library workflows.
 - `govoplan-mail` enables reusable mail profiles, delivery policy checks, SMTP sending, and IMAP append behavior. Without it, campaigns can still be authored, validated, built, and reported, but real delivery/profile features are unavailable.
 
+Public campaign, version, job, and report responses expose business data and
+delivery evidence, but never process-local paths, storage-backend keys, or
+worker claim tokens. Operational troubleshooting uses the dedicated job
+diagnostics endpoint and requires the tenant-level
+`campaigns:diagnostic:read` permission. The campaign sender role receives this
+permission; tenant-wide administrator scopes continue to grant it through the
+standard policy evaluator.
+
 Backend optional behavior is accessed through core-provided capabilities, not direct required imports. WebUI optional behavior uses core module metadata/capabilities so campaign pages can build and run without files or mail WebUI packages installed.
 
 Campaign also provides narrow kernel capabilities so other modules and core