feat: add governed cross-module reporting

docs/OPERATIONS.md

@@ -12,6 +12,15 @@ claim bounded batches, retain success or failure state, and advance interval
 time from the claimed occurrence. Providers must use the same tenant and
 principal context and must enforce their source-side authorization.
 
+Provider-report executions and exports are database evidence. Each execution
+stores the exact provider/report revision, request hash, source revisions,
+effective scope, applied privacy transforms, governance decision provenance,
+generation actor/time, retention expiry, and output hash. Export rows retain
+their own purpose, audience, actor/time, format, and hash. Expired provider
+results are rejected by retrieval and export paths; run the platform privacy
+retention process on schedule to remove or minimize expired stored detail in
+accordance with the active Policy.
+
 ## Security controls
 
 - The semantic engine never evaluates Python, browser code, raw SQL, stored
@@ -25,6 +34,10 @@ principal context and must enforce their source-side authorization.
 - Freshness, schema, fingerprints, quality gates, definition hashes, source
   provenance, actor, and output hash are retained with every run.
 - CSV formula injection is neutralized before direct download.
+- Provider exceptions are isolated in catalogue diagnostics; an unavailable
+  optional provider cannot take down the global report catalogue.
+- High re-identification-risk provider reports fail closed unless an installed
+  Policy capability explicitly permits them.
 
 ## Backup and restore