Implement AUDIT-WP-0006 honest operational custody.

Postgres now reports custody_class=operational with a cited 30-day
recoverable window. Join ITC-CAP operations.audit at D4, publish the
interface card, and overlay user-engine tenants [*] from Git so an
ExternalSecret refresh cannot shrink it.

tests/test_backend_conformance.py

@@ -86,7 +86,11 @@ def digest(event: AuditEvent) -> str:
 def test_declares_a_retention_policy(backend):
     policy = backend.retention_policy
     assert policy.durable is True
-    assert policy.custody_class in ("development", "archive", "hot_search")
+    assert policy.custody_class in ("development", "operational", "archive", "hot_search")
+    if policy.custody_class == "operational":
+        assert policy.recoverable_days == 30
+        assert policy.recoverable_basis == "measured"
+        assert policy.recoverable_source
     # A backend claiming tamper evidence must also claim immutability;
     # the reverse is allowed.
     if policy.tamper_evidence: