Implement AUDIT-WP-0006 honest operational custody.

Postgres now reports custody_class=operational with a cited 30-day
recoverable window. Join ITC-CAP operations.audit at D4, publish the
interface card, and overlay user-engine tenants [*] from Git so an
ExternalSecret refresh cannot shrink it.

audit_core/postgres_backend.py

@@ -151,6 +151,12 @@ class PostgresAuditBackend:
         *,
         schema: str = DEFAULT_SCHEMA,
         retention_days: int | None = None,
+        recoverable_days: int | None = 30,
+        recoverable_source: str | None = (
+            "resource-control/data/capability/platform-audit-storage.json"
+            "#provisions[capability=data.backup]"
+        ),
+        recoverable_basis: str | None = "measured",
         min_size: int = 1,
         max_size: int = 8,
         statement_timeout_ms: int = 30_000,
@@ -178,6 +184,9 @@ class PostgresAuditBackend:
             raise ValueError(f"unsafe schema name: {schema!r}")
         self.schema = schema
         self.retention_days = retention_days
+        self.recoverable_days = recoverable_days
+        self.recoverable_source = recoverable_source
+        self.recoverable_basis = recoverable_basis
         base_kwargs = {
             "autocommit": True,
             # A stalled write must surface as unavailable rather than hold a
@@ -266,13 +275,22 @@ class PostgresAuditBackend:
         who can drop the trigger; ``tamper_evidence`` is correspondingly False,
         because nothing here would *prove* they had. Hash-chaining or external
         anchoring would be needed for that, and is not implemented.
+
+        ``custody_class`` is ``operational``, not ``archive``. This store is
+        durable append-only Postgres recovered through the platform
+        ``data.backup`` provision. It is not ITC-CAP ``data.archive`` (WORM
+        object storage, manifests, retrieval tests). Recoverable history is
+        the cited platform window, not ``retention_days``.
         """
         return RetentionPolicy(
-            custody_class="archive",
+            custody_class="operational",
             retention_days=self.retention_days,
             immutable=True,
             tamper_evidence=False,
             durable=True,
+            recoverable_days=self.recoverable_days,
+            recoverable_source=self.recoverable_source,
+            recoverable_basis=self.recoverable_basis,
         )
 
     def emit(self, event: AuditEvent) -> str: