Summary

Closes the Tranche 1 security and evidence-integrity gaps:

• Enforces gateway capability scopes, request auditing, bounded rate limits, and retry metadata.
• Makes SOPS secret loading fail closed outside explicit development/test plaintext mode.
• Adds data-stream publication, privacy, attachment, comment, and immutability governance in migrations 331 and 332.
• Adds shared field-ingestion validation and source provenance for sensor, HTTP, and MQTT paths.
• Updates Directus governance registration, documentation, pilot seed metadata, and regression coverage.

Verification

• Clean PostgreSQL bootstrap passed.
• Pilot data seed passed with publication governance enabled.
• Seed idempotency passed, including the second seed-pilot.sh run.
• Full test suite: 3,889 passed, 1 warning.
• Ruff security scan passed.
• pip-audit passed with no known vulnerabilities.
• Directus TypeScript build passed.
• ClickHouse and Directus setup passed.

CI

• Successful build: KI-278
• Previous failures KI-276 and KI-277 were fixed by commits 6ee2c71 and 39fe870.