feat(postbox): add governed content protection profiles

README.md

@@ -103,12 +103,22 @@ an independently readable copy in the next frozen function Postbox. The
 `govoplan.postbox.dispatch_routes` periodic Core worker drains due routes when
 Celery beat and a worker consuming the `postbox` queue are enabled.
 
-Postboxes support `plaintext_v1` and an optional `server_envelope_v1` profile.
-The latter stores message bodies as ciphertext through the Encryption
-capability and fails closed on reads if that capability or key is unavailable.
+Postboxes expose three configurable content-protection profiles. The recommended
+`server_envelope_v1` profile stores message bodies as ciphertext through an
+institution-controlled Encryption vault and fails closed if its capability or
+key is unavailable. `external_e2ee_v1` accepts only ciphertext, a signed
+manifest, wrapped recipient keys, and a verified content digest produced by an
+approved external client; GovOPlaN cannot decrypt that content. `plaintext_v1`
+keeps content unencrypted for deployments that explicitly accept that boundary.
 Subjects, participants, routing, attachment references, and lifecycle metadata
-remain observable. Existing externally produced ciphertext references remain
-supported, but neither path is described as end-to-end encryption.
+remain observable in every profile.
+
+Administrators may govern future-only changes or migrate retained history.
+Transitions record user-consent and/or institutional key-holder evidence,
+quorum, reason, per-message digest continuity, and completion state. Managed
+envelope changes use the Encryption migration ledger. Any transition to or from
+E2EE waits for client-supplied transforms for historical messages; the module
+does not claim or silently simulate native browser/device key custody.
 
 Run focused checks with: