Implement AUDIT-WP-0006 honest operational custody.

Postgres now reports custody_class=operational with a cited 30-day
recoverable window. Join ITC-CAP operations.audit at D4, publish the
interface card, and overlay user-engine tenants [*] from Git so an
ExternalSecret refresh cannot shrink it.

docs/interface-card.yaml

@@ -0,0 +1,99 @@
+schema: info-tech-canon.interface-card.v1
+id: audit-core/interface-card
+title: audit-core Canon Interface Card
+consumer: audit-core
+consumer_profile:
+  repo: audit-core
+  domain: infotech
+  owner: audit-core
+  intent: >
+    Provide durable, tenant-aware operational custody for audit events so
+    senders can treat a 202 as evidence-in-store, not a log-forwarding hint.
+  scope:
+    - audit event ingestion
+    - append-only operational custody
+    - sender binding
+    - recovery bound to platform backup
+  purposes:
+    - id: audit-core/operational-custody
+      use_case: Accept normalized events from registered senders and retain them in an append-only store.
+      consumer_need: A joinable operations.audit provision with an honest recovery claim.
+      demand_signals:
+        - user-engine delivers platform and tenant events over POST /v1/events
+        - neighbours already require data.backup in ITC-CAP terms
+canon_surfaces:
+  - model/capability
+  - model/governance
+  - model/data
+  - model/security
+surfaces:
+  implemented_profiles: []
+  consumed_artifacts:
+    - model/capability
+    - model/governance
+    - model/data
+    - model/security
+  owned_concepts: []
+  produced_concepts:
+    - Evidence
+    - AuditRecord
+  consumed_concepts:
+    - Evidence
+    - EvidenceBasis
+    - CapabilityProvision
+    - RetentionRuleReference
+  mappings:
+    - from: stored event
+      to: Evidence / AuditRecord
+      note: This service stores evidence. It is not an independent Audit-as-assessment.
+    - from: capability.audit.event-retain
+      to: operations.audit
+      note: data/capability/audit-core-operational.json
+validation_expectations:
+  commands:
+    - PYTHONPATH=src python3 -m info_tech_canon capability-review /home/worsch/audit-core/data/capability/audit-core-operational.json
+  evidence_required:
+    - data/capability/audit-core-operational.json
+    - docs/operator-runbook.md Restore section
+    - docs/evidence/restore-walk-20260813T121200Z.json
+  known_gaps:
+    - id: data.archive-unprovided
+      owner: audit-core
+      disposition: unmet requirement recorded on the ITC-CAP case; do not build the sink in AUDIT-WP-0006
+    - id: tamper-evidence-false
+      owner: audit-core
+      disposition: integrity_verification hook is unknown; trigger is not a proof
+    - id: no-hash-chain
+      owner: audit-core
+      disposition: INTENT residual, not this workplan
+    - id: single-sender
+      owner: audit-core
+      disposition: NetworkPolicy admits user-engine only; other sources remain adapters
+    - id: no-rapp-yaml
+      owner: railiance-master
+      disposition: schema requires rapp-*; extraction is a first-wave family decision
+    - id: historic-archive-overclaim
+      owner: audit-core
+      disposition: closed by AUDIT-WP-0006-T01; /readyz reports operational
+purpose_fit:
+  state: partial
+  matched_capabilities:
+    - operations.audit
+  scope_pressure: >
+    INTENT describes a control plane, object archive, hot search, and export.
+    The live service is a single-sender operational custody receiver.
+  recommended_disposition: keep the operational provision honest; do not inflate to data.archive
+consumer_needs:
+  current:
+    - Honest custody_class and recoverable window on /readyz
+    - Joinable operations.audit provision
+  requested_extensions:
+    - data.archive sink if events must survive past the 30-day backup window
+  feedback: []
+known_deviations:
+  - no data.archive sink
+  - tamper_evidence=False
+  - no hash-chain
+  - single sender user-engine
+  - no rapp.yaml (not a rapp-* repo)
+  - /readyz historically overclaimed archive (closed by T01)