feat(xrechnung): govern validation profile selection

docs/INBOUND_VALIDATION.md

@@ -6,6 +6,25 @@ This module validates an inbound XML invoice through a locally installed, exact
 
 An administrator records the XRechnung version, validator version, configuration release, absolute Java and JAR paths, JAR SHA-256, configuration root and complete deterministic tree SHA-256, scenario file, and expected minimum validation-step count. Every run rechecks the executable and both artifact digests. Symbolic links and files outside the configuration root are rejected.
 
+## Deployment-owned profile allow-list
+
+`KoSITProfileRegistry` allows a deployment to approve several exact profiles
+without GovOPlaN choosing a standard version. Each approval binds the verified
+artifact digest, approving actor, decision reference, receive-time window, and
+the state `approved`, `suspended`, or `retired`. A deployment may configure one
+explicit default, or require the invoking workflow to select a profile every
+time. A default is never inferred.
+
+Selection uses the invoice receive time, which permits an administrator to
+model an overlap or transition window. Suspended, retired, unknown, expired,
+not-yet-valid, or subsequently modified profiles fail closed. Artifact digests
+are rechecked on selection and again during validation.
+
+Administrierende können damit mehrere konkrete Profile zeitlich begrenzt
+freigeben, ohne dass GovOPlaN eine XRechnungs-Version vorgibt. Übergangsfristen
+und ein Standardprofil sind ausdrücklich konfigurierte Entscheidungen. Ohne
+Standard muss jeder aufrufende Prozess ein freigegebenes Profil benennen.
+
 The configuration tree must be installed through deployment governance. A newer published release never becomes active automatically. Updating any artifact creates a different profile digest and requires regression evidence with accepted, rejected, malformed, and deliberately broken technical fixtures.
 
 ## Fail-closed validation