[P1][SEC-03] Vault, encryption and information-flow controls

Parent: #1

## Objective
Protect credentials and private context across profiles, workspaces, connectors, agents, sync and derived data. Local-first must be an enforceable data-flow property, not a UI badge.

## Scope
- OS-backed secret vault abstraction and scoped credential handles.
- Profile/workspace encryption keys, key rotation and recovery hooks.
- Access labels on observations, evidence, artifacts, embeddings, summaries and memory.
- Destination restrictions for local inference, named cloud providers, exports and shared workspaces.
- Conservative propagation of restrictions through deterministic/model-derived outputs.
- Deletion/forget workflows covering indexes, caches and future context eligibility.

## Design requirements
- Secrets never appear in prompts, ordinary worker environments or diagnostic traces.
- Cloud-provider permission does not imply all readable local context can be uploaded.
- Work/personal/private-session scopes remain isolated.

## Acceptance criteria
- [ ] Private inputs cannot reach an unauthorized provider, connector, export or shared workspace.
- [ ] Credentials are brokered by handle and remain absent from model context/logs.
- [ ] Derived summaries/embeddings inherit conservative restrictions from sensitive inputs.
- [ ] Deletion removes searchable derivatives and future retrieval eligibility.
- [ ] Profile/workspace key rotation preserves authorized data and invalidates retired keys.
- [ ] Privacy-mode transitions are explicit and auditable; no hidden cloud fallback.

## Dependencies
- SEC-02
- CORE-02

**First phase:** P1
**Maturity target:** P6
**Workstream:** Authority and security

Start by reading the SEC-02 and CORE-02 dependencies and the parent issue #1 to establish the surrounding architecture. Break the scope into vault handles, key rotation, access-label propagation, destination restrictions, deletion, and auditable privacy transitions. Done means every listed acceptance criterion is demonstrated, including blocked unauthorized flows and removal of searchable derivatives.

Written by the indexing model from the issue text.