Govern full replay export as DISCLOSE

[SarashaElion]

Summary

Build 025 makes full replay-bundle export a governed disclosure boundary rather than an unrestricted serialization path.

DISCLOSE boundary

• export_replay_bundle(relationship, actor=...) now requires active DISCLOSE authority on the relationship aggregate resource
• replay_export_resource(relationship_id) exposes the canonical aggregate resource key
• READ does not substitute for DISCLOSE
• purpose, expiry, conditions, lifecycle restrictions, revocation, and ambiguous permission-race semantics are enforced through the ordinary capability path
• denied export raises public ReplayExportError

Audit semantics

• every attempted replay export records its governance decision
• authorized export records ALLOW before bundle construction
• therefore the exported history contains the governance event that authorized the disclosure

Consent boundary

• this build does not collapse consent into permission
• applications that require consent for export must enforce it separately, preserving TRIA's existing consent/permission separation

Verification/import

• verification and import remain authorization-neutral because they operate on an artifact already supplied to the caller
• neither operation grants authority to disclose the source relationship

Conformance

• tests cover no authority, READ-only authority, successful DISCLOSE, purpose-bound disclosure, and explicit conditions
• existing replay/export tests now grant aggregate DISCLOSE explicitly
• portable replay documentation and conformance manifest updated

Architectural intent

Persistence portability must not become an accidental data-exfiltration path. A full relational replay bundle can contain claim contents and sensitive relational history, so exporting it is a disclosure operation.

This is Core hardening only. It does not change event schema, projection version, bundle format, hashing semantics, federation, or cross-language protocol behavior.