feat: add governed cross-module reporting

README.md

@@ -20,6 +20,9 @@ The module now provides an executable governed semantic-reporting vertical:
   arbitrary report SQL;
 - quality gates, saved views, interval/scheduled runs, CSV/JSON export,
   provider-neutral publication targets, and import activation assessments;
+- a versioned, provider-neutral cross-module report contract with source-owned
+  authorization, declared result schemas, privacy transforms, effective scope,
+  source revisions, purpose, retention, export history, and audit provenance;
 - a full-height Reporting workspace for running, inspecting, saving,
   scheduling, visualizing, and exporting authorized reports.
 
@@ -27,6 +30,10 @@ Reporting consumes Dataflow outputs or provider-owned read models. It does not
 read another module's ORM tables or take ownership of ingestion and
 transformation.
 
+The canonical global route is `/reports`. `/reporting` remains a
+Reporting-owned compatibility route for saved links. Domain modules may keep
+their own operational report routes, but do not register `/reports`.
+
 See [docs/REPORTING_BOUNDARY.md](docs/REPORTING_BOUNDARY.md) for the boundary
 decision. The behavior-level comparison with the supplied SuperX module set is
 recorded in