Implement AUDIT-WP-0006 honest operational custody.

Postgres now reports custody_class=operational with a cited 30-day
recoverable window. Join ITC-CAP operations.audit at D4, publish the
interface card, and overlay user-engine tenants [*] from Git so an
ExternalSecret refresh cannot shrink it.

deploy/senders-scope.json

@@ -0,0 +1,9 @@
+[
+  {
+    "name": "user-engine",
+    "sources": ["user-engine"],
+    "tenants": ["*"],
+    "may_write": true,
+    "may_read": false
+  }
+]