[Story]: Privacy aggregation-floor policy layer

## Summary
Enforce a minimum-cohort aggregation floor uniformly across every connector, using Copilot's 5-seat rule as the reference minimum, so that small teams cannot be de-anonymized by cross-referencing adoption/acceptance data. This must land alongside the first connectors, not retrofitted afterward.

## Intent / Source of truth
2026-08-13 backlog consolidation: "we are an AI-governance vendor and must model the discipline we sell." Copilot's own 5-seat-per-day minimum (story 3) as the reference floor.

## Scope
- [ ] A shared, connector-agnostic aggregation-floor policy layer (minimum cohort size before any per-user-adjacent data is surfaced)
- [ ] Applied uniformly to every connector from day one — not vendor-by-vendor opt-in
- [ ] Documented policy (what the floor is, why, and what happens when a cohort is below it — e.g. suppressed panel vs. rolled-up-to-parent-team)

## Out of scope
- Per-vendor custom floors that diverge from the shared policy without a documented reason
- Retroactive redaction of already-shipped dashboards (this should land alongside, per the "not afterwards" requirement — if any connector ships before this, that's a defect to flag, not accept)

## Verification
A test cohort below the floor shows suppressed/rolled-up data, not raw small-N numbers, across at least two different connectors' dashboards.

## Risk assessment
This is a trust/positioning risk for an AI-governance vendor specifically — shipping any connector without this floor in place first would be a credibility problem, not just a technical gap. Treat "lands alongside the first connectors" as a hard sequencing requirement.

## AI Usage Declaration
Drafted with AI assistance during the 2026-08-13 cross-repo backlog consolidation. A human owns intent, verification and consequences; acceptance criteria must be verified against the live system before this is closed.