feat(datasources): govern approvals and retention

tests/test_dsar_provider.py

@@ -20,6 +20,7 @@ from govoplan_core.privacy.dsar_workflow import (
 )
 from govoplan_datasources.backend.db.models import (
     DatasourceGovernanceReferenceRecord,
+    DatasourceLifecycleEvidenceRecord,
     DatasourceMaterializationRecord,
     DatasourcePayloadRecord,
     DatasourcePayloadRowRecord,
@@ -382,6 +383,54 @@ class DatasourcesDsarProviderTests(unittest.TestCase):
         self.assertEqual((), wrong_tenant)
         self.assertEqual((), conflict)
 
+    def test_lifecycle_evidence_is_minimized_and_immutable(self) -> None:
+        evidence = DatasourceLifecycleEvidenceRecord(
+            id="evidence-1",
+            tenant_id="tenant-1",
+            subject_ref="datasource:datasource-1",
+            event_type="retention.applied",
+            occurred_at=NOW,
+            actor_ref="account-1",
+            policy_version="retention-v1",
+            policy_hash="1" * 64,
+            subject_digest="2" * 64,
+            event_hash="3" * 64,
+            details_={"secret": SECRET},
+        )
+        self.session.add(evidence)
+        self.session.commit()
+
+        exact_subject = DsarSubjectRef(
+            external_references={
+                "datasources.lifecycle_evidence": "evidence-1",
+            }
+        )
+        exact = self.provider.search_subject(
+            self.session,
+            tenant_id="tenant-1",
+            subject=exact_subject,
+        )
+        self.assertEqual(1, len(exact))
+        self.assertEqual("datasource_operator_attribution", exact[0].category)
+        self.assertNotIn(SECRET, json.dumps(exact[0].to_dict()))
+        actions = self.provider.plan_erasure(
+            self.session,
+            tenant_id="tenant-1",
+            subject=exact_subject,
+            records=exact,
+        )
+        self.assertEqual({"retain"}, {action.kind for action in actions})
+
+        canonical = self.provider.search_subject(
+            self.session,
+            tenant_id="tenant-1",
+            subject=DsarSubjectRef(account_id="account-1"),
+        )
+        self.assertIn(
+            "datasource_lifecycle_evidence",
+            {record.resource_type for record in canonical},
+        )
+
     def test_transient_deletion_is_safe_and_idempotent(self) -> None:
         subject = DsarSubjectRef(
             external_references={