Implement AUDIT-WP-0006 honest operational custody.

Postgres now reports custody_class=operational with a cited 30-day
recoverable window. Join ITC-CAP operations.audit at D4, publish the
interface card, and overlay user-engine tenants [*] from Git so an
ExternalSecret refresh cannot shrink it.

deploy/audit-core.yaml

@@ -90,11 +90,11 @@ spec:
               value: "0.0.0.0"
             - name: AUDIT_CORE_HTTP_PORT
               value: "8080"
-            # Refuses to start on anything but archive-class custody, so a
-            # missing database URL fails loudly instead of silently downgrading
-            # to the development store.
+            # Refuses to start on anything but operational (durable Postgres)
+            # custody. ``archive`` remains an accepted alias for one mixed
+            # rollout so an old manifest cannot refuse a new image.
             - name: AUDIT_CORE_REQUIRE_CUSTODY_CLASS
-              value: archive
+              value: operational
             # Runtime role cannot CREATE TABLE. Schema changes are a Job
             # with the migration lease (deploy/migrate-job.yaml).
             - name: AUDIT_CORE_AUTO_MIGRATE
@@ -122,6 +122,11 @@ spec:
                 secretKeyRef:
                   name: audit-core-senders
                   key: senders.json
+            # Non-secret tenant/source scope. Tokens stay in the Secret;
+            # ExternalSecret refresh cannot shrink user-engine tenants
+            # below deploy/senders-scope.json.
+            - name: AUDIT_CORE_SENDERS_SCOPE_PATH
+              value: /etc/audit-core/senders-scope.json
           resources:
             requests:
               cpu: 50m
@@ -144,6 +149,10 @@ spec:
             - name: database-credential
               mountPath: /etc/audit-core/db
               readOnly: true
+            - name: senders-scope
+              mountPath: /etc/audit-core/senders-scope.json
+              subPath: senders-scope.json
+              readOnly: true
           startupProbe:
             httpGet: {path: /healthz, port: http}
             periodSeconds: 3
@@ -175,3 +184,7 @@ spec:
             secretName: audit-core-database
             # 0440 + fsGroup 10001: 0400 is root-only and the process cannot read it.
             defaultMode: 0440
+        - name: senders-scope
+          configMap:
+            name: audit-core-senders-scope
+            defaultMode: 0444