Expose sanitized backup restore evidence

docs/BACKUP_EVIDENCE_STATUS.md

@@ -0,0 +1,22 @@
+# Backup Evidence Status
+
+The Ops health surface reports the sanitized result of deployment-side backup
+verification. It never reads backup artifacts, provider URLs, credentials,
+encryption-key references, signing keys, or orchestrator APIs.
+
+The status can be:
+
+- `verified`: a signed coordinated PostgreSQL, object, configuration, and key
+  custody recovery point and its isolated restore drill are current;
+- `expired`: the retained receipt is no longer fresh enough to authorize a
+  release-changing migration;
+- `absent`: no signed receipt has been adopted;
+- `invalid`: the deployment verifier rejected, lost, or only partially received
+  the evidence set.
+
+The panel shows the recovery point and drill identifiers, capture/expiry times,
+component count, and measured RPO/RTO. These values help operators find the
+private report in the approved evidence store; they are not themselves a
+backup. Resolve an absent, expired, or invalid state through the deployment
+runbook and `govoplan-deploy verify-backup --adopt`, then reconcile the runtime
+environment. Do not upload provider reports or keys through the application.