[P0][SEC-05] Privacy governance and incident process

Parent: #1

## Objective
Treat privacy, legal access, data lifecycle, publisher/payment obligations and incident response as engineering constraints from the first release rather than post-launch paperwork.

## Scope
- Data inventory and data-flow map across local, connector, cloud-agent and sync paths.
- DPIA/privacy-by-design review, retention/deletion schedules and telemetry consent.
- Publisher/content caching, quotation, attribution and redistribution policy hooks.
- Model/license, extension license and third-party binary redistribution review.
- Payment/PCI boundary documentation; avoid handling raw card data where provider/tokenized flows exist.
- Security/privacy incident classification, revocation, disclosure and recovery playbooks.
- User export/deletion exercises and provider-account revocation behavior.

## Acceptance criteria
- [ ] Each shipped data flow has a declared purpose, retention rule and destination.
- [ ] Privacy mode/telemetry choices are enforceable and testable.
- [ ] User deletion removes eligible local derivatives and schedules/requests applicable remote deletion.
- [ ] Provider/publisher/payment agreements required for advertised capabilities are recorded before launch.
- [ ] Incident exercise demonstrates credential/connector/package revocation and safe client recovery.
- [ ] Product claims accurately distinguish local inference, network privacy and cloud processing.

## Dependencies
- SEC-01

**First phase:** P0
**Maturity target:** P7 (continuous)
**Workstream:** Authority and security

No files, tests, or entry points are named; start by reviewing SEC-01 and mapping the listed local, connector, cloud-agent, and sync data flows. Done means the acceptance criteria are implemented and documented, including enforceable privacy choices, deletion behavior, required agreements, an incident exercise, and accurate processing claims.

Written by the indexing model from the issue text.