Add governed encryption administration

README.md

@@ -19,6 +19,8 @@ recovery ceremonies, and disable/uninstall assurance.
 - resumable, evidence-backed rewrap, re-encryption, decrypt, export, and destroy
   state transitions;
 - recent high-assurance, distinct-custodian quorum recovery authorization;
+- bounded tenant administration for safe vault/envelope status, key lifecycle,
+  two-phase migration coordination, recovery decisions, and disable preflight;
 - typed APIs, audit-safe events, Alembic migration, and uninstall blocking;
 - a bundled `local_aesgcm` server-envelope provider using AES-256-GCM and
   SQL-persisted wrapped vault/content keys;
@@ -44,6 +46,12 @@ Feature modules continue to own content, authorization, retention, and resource
 ownership. Access approval, resource ownership, Identity Trust, and key custody
 are separate decisions.
 
+The administration surface intentionally omits provider key references, wrapped
+key references, ciphertext locations, and cryptographic material. Lifecycle
+commands require policy and assurance references; destructive actions explain
+their irreversibility and do not imply that previously obtained plaintext can be
+recalled.
+
 See [docs/ENCRYPTION_BOUNDARY.md](docs/ENCRYPTION_BOUNDARY.md) for the threat
 model, profile consequences, algorithms, recovery, and disable semantics.