feat(reporting): add governed DSAR coverage

README.md

@@ -37,6 +37,23 @@ The canonical global route is `/reports`. `/reporting` remains a
 Reporting-owned compatibility route for saved links. Domain modules may keep
 their own operational report routes, but do not register `/reports`.
 
+## Data-subject requests
+
+Reporting publishes `privacy.dsar.reporting` for private saved views,
+short-lived drill contexts, subject access grants, minimized staff
+attribution, and explicitly identified retained executions, exports, and
+publications. DSAR output never copies report rows, parameters, filters,
+delivery targets, source payloads, diagnostics, provenance bodies, or hashes.
+The source module remains responsible for locating and correcting subject
+facts; arbitrary aggregate report output is not searched as if Reporting were
+the authoritative owner.
+
+Private views and drill contexts can be removed, grants revoked, and exact
+retained result or publication detail minimized idempotently. Shared views,
+definitions, schedules, quality/import evidence, and institutional attribution
+require authorized review or retention. Source facts must be corrected before
+rerunning or republishing a report.
+
 See [docs/REPORTING_BOUNDARY.md](docs/REPORTING_BOUNDARY.md) for the boundary
 decision. The behavior-level comparison with the supplied SuperX module set is
 recorded in