release: align governed tenant erasure

docs/evidence/snapshots/DSAR_PROVIDER_COVERAGE.generated.md

@@ -6,8 +6,8 @@ Every other active module requires a reviewed explanation of why it owns no
 persistent subject-data store. Adding a migration invalidates that explanation.
 
 - Active modules: 72
-- Registered and documented DSAR providers: 48
-- Reviewed no-store rationales: 24
+- Registered and documented DSAR providers: 49
+- Reviewed no-store rationales: 23
 - Unexplained coverage gaps: 0
 
 | Module | Repository | Persistence | Coverage | Rationale |
@@ -75,7 +75,7 @@ persistent subject-data store. Adding a migration invalidates that explanation.
 | `soap` | `govoplan-soap` | No module migration | Reviewed no-store rationale | Transport-only module: SOAP binds explicitly published operations and owns no domain or subject-data store. |
 | `tasks` | `govoplan-tasks` | Migration-owned | Provider | Provider `privacy.dsar.tasks` is registered and documented. |
 | `templates` | `govoplan-templates` | Migration-owned | Provider | Provider `privacy.dsar.templates` is registered and documented. |
-| `tenancy` | `govoplan-tenancy` | No module migration | Reviewed no-store rationale | Orchestration module: tenant lifecycle and settings use Core-owned storage; Access covers account and membership subject data. |
+| `tenancy` | `govoplan-tenancy` | Migration-owned | Provider | Provider `privacy.dsar.tenancy` is registered and documented. |
 | `tickets` | `govoplan-tickets` | Migration-owned | Provider | Provider `privacy.dsar.tickets` is registered and documented. |
 | `transparency` | `govoplan-transparency` | No module migration | Reviewed no-store rationale | Contract-only module: requests, disclosure reviews, and publications are not persisted; reassess before adding a migration-owned store. |
 | `views` | `govoplan-views` | Migration-owned | Provider | Provider `privacy.dsar.views` is registered and documented. |