docs: define connector secret retirement

docs/CONNECTED_GOVERNANCE_PLATFORM_ROADMAP.md

@@ -1012,6 +1012,9 @@ Priorities:
    contracts from proven Campaign and Calendar behavior.
 4. Implement connector inventory/profiles, source-of-truth declarations,
    health, secret references, webhooks/polling evidence, and lifecycle.
+   Connector/provider deletion and destructive module retirement immediately
+   remove provider-owned secrets and emit non-secret audit evidence; failed
+   external-secret deletion fails closed.
 5. Let modules contribute object regions, actions, work items, and focused-view
    fragments through Core without optional sibling imports.
 6. Expand configuration-package providers, dry-run, apply, export, upgrade,

docs/REFERENCE_JOURNEY_PROGRAM.md

@@ -47,7 +47,10 @@ journey needs and supplies contracts shared by all five stages.
    source-of-truth mode, capabilities, health, limits, credential references,
    and lifecycle. Network destinations are resolved and pinned at connection
    time; private-network access is deployment-controlled and unpinned private
-   transports fail closed.
+   transports fail closed. Deleting a connector or provider immediately
+   deletes every secret it owns and records a non-secret audit event in the
+   same lifecycle action; an unavailable external secret provider blocks the
+   deletion or retirement rather than leaving an unaudited orphan.
 2. **External effects.** Requested action, durable command, observed effect,
    unknown outcome, retry, reconciliation, compensation/correction, and manual
    intervention remain distinct and auditable.
@@ -69,6 +72,13 @@ journey needs and supplies contracts shared by all five stages.
 8. **Release proof.** Version alignment, clean install/upgrade, module
    permutations, backup/restore, degraded-provider behavior, security checks,
    and target-environment acceptance gate product claims.
+9. **Artifact and infrastructure egress.** Tenant connectors use the pinned
+   connector boundary. Installer artifacts use a separate deployment-owned
+   trust path: approved origins, bounded pinned download or operator prefetch,
+   signature/checksum verification, safe extraction, and offline package-manager
+   execution. Database, broker, cache, and worker channels are constrained by
+   deployment network policy and authenticated transport rather than treated as
+   tenant connector profiles.
 
 ## Documentation contract for every reference stage
 

docs/SYSTEM_ADMINISTRATOR_LIFECYCLE_USER_STORY.md

@@ -70,10 +70,16 @@ The canonical backlog item is
    state and can reconnect without losing progress.
 5. Package signature/checksum, version alignment, contract closure, migration
    graph, configuration schema, and health checks are mandatory gates.
-6. A failed or interrupted operation reaches a visible retry, forward-recovery,
+6. Remote artifacts are acquired by a deployment-owned downloader that permits
+   approved origins, pins the validated connection peer, enforces size and time
+   limits, and verifies signature/checksum before making a local immutable
+   artifact available. `pip`, `npm`, archive tools, and any compatibility Git
+   importer then run without unrestricted network access. A restricted-network
+   profile can satisfy the same contract through operator-prefetched artifacts.
+7. A failed or interrupted operation reaches a visible retry, forward-recovery,
    rollback, or manual-intervention state. It never reports success merely
    because the initiating request returned.
-7. An available update follows the same preview and confirmation path. Exact
+8. An available update follows the same preview and confirmation path. Exact
    repeated requests are idempotent.
 
 ### Horizontal scaling
@@ -114,6 +120,10 @@ The canonical backlog item is
 
 - Catalogs, artifacts, recipes, and configuration revisions have signatures,
   checksums, provenance, expiry/revocation semantics, and audit evidence.
+- Catalog and artifact retrieval is not delegated to an unrestricted package
+  manager. Approved-origin and peer-pinned download, response bounds,
+  signature/checksum verification, extraction safety, offline installation, and
+  deployment egress policy form separate defenses.
 - The installer has a dedicated narrow authority; normal domain permissions do
   not imply host/package-management access.
 - The UI distinguishes reversible configuration rollback from database or