feat(parties): add governed DSAR coverage

docs/PARTIES_DOMAIN.md

@@ -28,3 +28,22 @@ Party writes are append-only, replay-safe, tenant-bound, and protected by
 optimistic concurrency. The procedure identity cannot change across revisions.
 Database restore is the recovery unit; downstream effects preserve exact Party,
 contact-snapshot, and representation evidence references.
+
+## Data-subject requests
+
+Parties publishes the `privacy.dsar.parties` capability. A search uses the exact
+tenant plus a canonical identity, a supported account-backed external subject,
+or an explicit `parties.party`/`parties.revision` reference. Combining a direct
+reference with a conflicting canonical selector returns no data. The bounded
+search exports typed party, procedure, channel, snapshot, and representation
+facts. It never exports the raw JSON payload, free-text change reasons,
+evidence identifiers, or unrelated counterpart party identifiers. An account
+that only recorded a revision receives a separate, minimized attribution
+record rather than the affected party's content.
+
+Every stored revision and operator attribution is immutable accountability
+evidence and therefore receives a retention action. The current active party
+fact receives a non-executable manual-review action: an authorized operator
+must correct, expire, supersede, or explicitly revoke representation through
+the normal versioned lifecycle after reviewing procedural and third-party
+consequences. DSAR execution cannot mutate Parties data automatically.