feat: add governed cross-module reporting

docs/USER_GUIDE.md

@@ -2,8 +2,9 @@
 
 ## Open and run a report
 
-Open **Reporting** and choose an active report from the left catalogue. The
-header identifies the immutable report revision that will be used. Select a
+Open **Reporting** at `/reports` and choose a report from the left catalogue.
+The catalogue separates source-module reports from Reporting semantic reports.
+The header identifies the immutable report revision that will be used. Select a
 summary, detail, or pivot shape, choose dimensions and measures, enter any
 report parameters, and select **Run**.
 
@@ -30,3 +31,18 @@ spreadsheet formula marker are escaped.
 Users with scheduling permission can create an hourly, daily, weekly, or
 30-day interval from the current revision, parameters, and query. Scheduled
 runs continue to use those exact pins until the schedule is edited.
+
+## Run a module report
+
+Module reports retain their source module's access rules. Select the source
+object and any optional parameters, enter the concrete purpose for the run,
+and verify the effective tenant audience before selecting **Run**. Reporting
+will refuse a result that does not carry the declared privacy transforms,
+source revision, and tenant scope.
+
+The result groups declared metrics and details without exposing undeclared
+provider data. The Governance panel explains the risk class, permitted export
+formats, retention ceiling, contract version, and required privacy transforms.
+An export records a separate purpose, actor, audience, time, format, and output
+hash. A missing or restricted module report is not replaced with a less
+protected client-side query.