feat: scaffold encryption capability boundaries

AGENTS.md

@@ -0,0 +1,21 @@
+# GovOPlaN Encryption Codex Guide
+
+## Scope
+
+This repository owns optional cryptographic platform capabilities: vaults, key
+hierarchies, content-protection profiles, E2EE recipient and device keys,
+rotation, recovery ceremonies, and disable/uninstall assurance.
+
+## Boundaries
+
+- Core owns neutral capability contracts and module discovery.
+- Feature modules own plaintext semantics, authorization, retention, and normal
+  resource ownership.
+- This module may protect feature-owned payloads but must not become their
+  business-data store.
+- Never add placeholder, home-grown, or unauthenticated cryptography.
+- A disable or uninstall operation must prove that every protection reference
+  was decrypted, rewrapped, explicitly exported, or cryptographically deleted.
+- Ownership recovery and cryptographic key recovery are separate processes.
+
+Use Gitea issues as the canonical backlog and state log.