feat: add governed cross-module reporting

docs/ADMIN_GUIDE.md

@@ -32,6 +32,36 @@ the Reporting publication-target contract. The target receives one immutable
 execution payload and an idempotency key. It must return bounded evidence and
 must not expose credentials in that evidence.
 
+## Cross-module provider governance
+
+Source modules register `reporting.report_provider.<provider-id>` capabilities;
+do not grant Reporting direct table access to those modules. Review every
+descriptor's result schema, required privacy transforms, retention class,
+export formats, and re-identification risk before enabling it in production.
+Provider authorization remains mandatory even when the Reporting role allows
+the user to run reports.
+
+When Policy is enabled, configure `reporting_governance_policy` in system or
+tenant settings. Tenant settings may only tighten the system result. Supported
+fields are:
+
+```json
+{
+  "reporting_governance_policy": {
+    "allow_exports": true,
+    "allowed_export_formats": ["json"],
+    "allow_high_reidentification_risk": false,
+    "max_retention_days": 30,
+    "required_privacy_transforms": ["small_cell_suppression"]
+  }
+}
+```
+
+Malformed explicit policy fails closed. The ordinary privacy-retention setting
+`stored_report_detail_retention_days` is an additional ceiling. A tenant cannot
+re-enable an export format, high-risk report, or longer retention period that
+the system policy denied.
+
 ## Import assessments
 
 Import assessment accepts declarative metadata only. Native datasets,