feat: validate receipt-bound storage configuration

docs/FILES_HANDBOOK.md

@@ -62,6 +62,28 @@ The main domain objects are:
 | Campaign attachment use | Evidence connecting a campaign job or entry to an exact asset, version, blob, checksum, and stage | Retained for campaign execution evidence |
 | Form evidence upload grant | A one-use, hash-only bearer grant tied to an exact Form instance/revision, purpose, custodian, size, and media-type policy | Issued for at most 15 minutes, consumed by one managed upload, then retained as evidence provenance |
 
+## Deployment configuration packages
+
+Files registers the `files.configuration` capability for `managed_storage`
+fragments. Managed content storage is deployment-owned: the installer selects
+local persistent storage, managed Garage, or an external S3-compatible service
+and mounts a validated non-secret infrastructure capability receipt. Files
+does not copy that endpoint or its credentials into module-owned tables.
+
+Preflight compares the receipt's `files.storage` capability with the effective
+runtime backend. It validates backend kind, sanitized S3 endpoint, bucket,
+Garage management marker or external trust marker, an absolute persistent path
+for local storage, and the presence of Files-owned `env:` secret references.
+Secret values are never read into a plan, diagnostic, export, or fragment.
+
+When runtime and receipt agree, the plan reports `skip`: the desired binding is
+already effective, and repeated apply is a no-op. A mismatch blocks import and
+explains which deployment setting must be reconciled. The provider deliberately
+does not mutate process environment, migrate stored objects, probe remote
+storage, or reinterpret an infrastructure replacement as safe. Use the Files
+integrity and Ops checks after deployment and complete migration/recovery review
+before changing an active backend.
+
 ## User tasks
 
 The Files page is available at `/files`. Actions appear only when the current