feat(forms-runtime): add governed DSAR coverage

docs/FORMS_RUNTIME_DOMAIN_BOUNDARY.md

@@ -210,6 +210,27 @@ Destructive retirement is blocked while state exists and requires a verified
 database snapshot plus an export or retention decision for referenced evidence.
 No local generated files are required, so API and worker nodes remain stateless.
 
+## Data-subject requests
+
+Forms Runtime publishes `privacy.dsar.forms_runtime`. It correlates exact-tenant
+canonical actors, normalized email addresses against grant-specific hashes,
+applicant confirmations and acknowledgements, and explicit instance or
+lifecycle references. An assisted session prevents its operator from being
+mistaken for the applicant when the session identifies a different actor; the
+operator still receives a minimized accountability-attribution record.
+
+Corroborated subject instances export bounded form values and typed definition,
+status, intake, acknowledgement, status-access, token-lifecycle, and handoff
+facts. Credential-like value keys are redacted. Raw token/email hashes,
+idempotency and provider keys, request/payload hashes, opaque metadata/details,
+validation internals, evidence identifiers, errors, and unrelated submissions
+are excluded. Immutable revisions, events, handoffs, confirmations,
+acknowledgements, intake evidence, and minimized token lifecycle are retained.
+Current drafts and active status grants receive non-executable manual-review
+actions and may only be changed through authorized runtime lifecycles. Forms
+owns definitions, Portal owns presentation, and Cases/Workflow Engine own
+handoff targets.
+
 Public and assisted intake, Files-backed attachment evidence, and authenticated
 acknowledgements implement the approved first profiles. Conditional multi-page
 definitions are resolved from Forms, and native Case/Workflow handoffs execute