feat(forms-runtime): add governed DSAR coverage

README.md

@@ -16,6 +16,15 @@ Notifications owns email delivery, and Portal owns the applicant-facing page.
 
 Its runtime module ID is `forms_runtime`; the repository and Python distribution retain the hyphenated `govoplan-forms-runtime` name.
 
+The module also contributes `privacy.dsar.forms_runtime`. Exact-tenant actor,
+email-status, confirmation, acknowledgement, and explicit runtime selectors
+produce bounded submission and lifecycle exports. Assisted operators receive
+only attribution unless they are also the identified applicant. Credential-like
+form keys, access hashes, replay keys, opaque details, validation internals, and
+evidence identifiers are excluded. Immutable submission/handoff evidence is
+retained; current drafts and active status grants require manual review through
+their normal lifecycle, with no automatic DSAR mutation.
+
 The module persists tenant-bound immutable revisions and events, exposes bounded
 owner/manager APIs and WebUI routes, and provides both
 `forms_runtime.registry` and `forms_runtime.service_launcher`.