docs: define connector secret retirement

docs/CONNECTED_GOVERNANCE_PLATFORM_ROADMAP.md

@@ -1012,6 +1012,9 @@ Priorities:
    contracts from proven Campaign and Calendar behavior.
 4. Implement connector inventory/profiles, source-of-truth declarations,
    health, secret references, webhooks/polling evidence, and lifecycle.
+   Connector/provider deletion and destructive module retirement immediately
+   remove provider-owned secrets and emit non-secret audit evidence; failed
+   external-secret deletion fails closed.
 5. Let modules contribute object regions, actions, work items, and focused-view
    fragments through Core without optional sibling imports.
 6. Expand configuration-package providers, dry-run, apply, export, upgrade,

docs/REFERENCE_JOURNEY_PROGRAM.md

@@ -47,7 +47,10 @@ journey needs and supplies contracts shared by all five stages.
    source-of-truth mode, capabilities, health, limits, credential references,
    and lifecycle. Network destinations are resolved and pinned at connection
    time; private-network access is deployment-controlled and unpinned private
-   transports fail closed.
+   transports fail closed. Deleting a connector or provider immediately
+   deletes every secret it owns and records a non-secret audit event in the
+   same lifecycle action; an unavailable external secret provider blocks the
+   deletion or retirement rather than leaving an unaudited orphan.
 2. **External effects.** Requested action, durable command, observed effect,
    unknown outcome, retry, reconciliation, compensation/correction, and manual
    intervention remain distinct and auditable.