feat(postbox): add governed content protection profiles

src/govoplan_postbox/backend/content_protection.py

@@ -25,6 +25,8 @@ def protect_message_body(
     vault_id: str,
     plaintext: str,
     actor_id: str,
+    operation_ref: str = "v1",
+    policy_decision_ref: str = "postbox:configured-server-envelope:v1",
 ) -> ProtectedContent:
     capability = encryption_content_cipher(get_registry())
     if capability is None:
@@ -43,8 +45,8 @@ def protect_message_body(
                 vault_id=vault_id,
                 ciphertext_ref=f"postbox-db://messages/{message_id}/body",
                 plaintext=plaintext.encode("utf-8"),
-                policy_decision_ref="postbox:configured-server-envelope:v1",
-                idempotency_key=f"postbox-message:{message_id}:body:v1",
+                policy_decision_ref=policy_decision_ref,
+                idempotency_key=f"postbox-message:{message_id}:body:{operation_ref}",
                 actor_id=actor_id,
                 metadata={"content_type": "text/plain;charset=utf-8"},
             ),