feat: add governed cross-module reporting

docs/REPORTING_BOUNDARY.md

@@ -87,6 +87,29 @@ Reporting does not own:
 - `reporting.publication_target:*` capabilities can accept immutable result
   payloads without Reporting importing the target module.
 
+### Cross-module report providers
+
+Source modules contribute aggregate or otherwise minimized reports through
+`reporting.report_provider.<provider-id>`. Core owns contract version `1.0` and
+the provider-neutral DTOs. A provider must declare stable report and revision
+IDs, typed parameters, the complete result schema, privacy transforms,
+retention class, export formats, and re-identification risk. It must enforce
+source access before listing options or producing a result and must return
+source revisions, effective tenant scope, applied transforms, generation time,
+and bounded provenance.
+
+Reporting discovers these capabilities by prefix. It validates descriptors,
+rejects undeclared output fields, requires every mandatory transform, records
+purpose and effective audience, and persists immutable execution and export
+evidence. The optional `policy.reporting_governance` capability can tighten
+retention, export formats, required transforms, and high-risk handling. If
+Policy is absent, Reporting applies its restrictive built-in baseline and
+denies high-risk provider reports.
+
+This direction is intentionally one-way: source modules import only Core's
+contract and remain usable when Reporting is absent. Reporting never imports
+the source module or reads its ORM tables.
+
 ## Implemented Vertical
 
 The first complete vertical persists datasets, semantic models, reports,
@@ -120,6 +143,11 @@ unsupported executable behavior remains.
 The WebUI uses the platform module loader and common controls. It exposes a
 report catalogue, parameter and semantic-query controls, result visualization
 and table views, history/provenance, saved views, schedules, and downloads.
+The global `/reports` route is owned only by Reporting. `/reporting` is a
+documented compatibility path. Campaign's module-local aggregate view remains
+at `/campaigns/reports`; when both modules are enabled, the same safe aggregate
+projection is also contributed to the global catalogue through the provider
+contract.
 
 ## Remaining Product Depth