Establish privacy, governance, accessibility, and responsible-AI controls

Translate the project principles into testable product and operational controls.

### Deliverables
- Data-minimisation and retention requirements
- Provider, model, prompt, and deployment governance controls
- Accessibility requirements for core workflows
- Transparency, human oversight, and incident-handling requirements

### Done when
Controls are explicit, testable, and avoid unsupported compliance claims.

Start by translating the listed privacy, governance, accessibility, transparency, oversight, and incident-handling deliverables into explicit product and operational controls. Define how each control can be tested and verify that the resulting requirements avoid unsupported compliance claims.

Written by the indexing model from the issue text.