security(signals): enforce typed sensitivity and minimized evidence at the canonical pipeline

[forkwright]

Finding

GeoSignal is the canonical cross-domain envelope, but it has no typed
sensitivity or disclosure policy. Its domain payloads can carry device,
network, location, and OSINT identifiers, and its public metadata field
accepts arbitrary JSON. Phase 03 owns the shared signal/audit enforcement
boundary while later collectors and operator surfaces can otherwise persist or
export those values without one fail-closed minimization contract.

Evidence

• crates/koinon/src/signal.rs defines GeoSignal.kind, optional precise
  location and source_device, plus an arbitrary
  BTreeMap<CompactString, serde_json::Value> metadata surface.
• crates/semaino/src/pipeline.rs fans the full envelope through aggregation
  and convergence, but no sensitivity/access/retention/export type gates the
  path.
• Domain plans include MAC/BLE/DNS and provider-derived identifiers. A local
  logging convention in one adapter cannot enforce a canonical cross-domain
  privacy boundary.

Desired correction

Keep one explicit type/behavior/domain split:

• koinon is the sole stable schema/type home for GeoSignal, closed
  sensitivity classes, and minimized audit-envelope types.
• Phase 03 semaino owns validation, enforcement, minimization, durable
  audit-emission, and live-publication ordering. It does not create a shadow
  wrapper/type, and Phase 01 does not become the policy owner merely because
  the shared types live in koinon.
• Every domain adapter assigns/maps the sensitivity of its fields and rejects
  unclassified fields. The domain retains raw acquisition plus authenticated
  storage, access, retention, and export policy.
• Export and operator views enforce the canonical class/policy and fail closed
  on unknown class, unauthorized consumer/persona, unknown
  version/provenance, or integrity failure.
• Protected signal replay/export consumes accepted security(runtime): authorize direct effects through one validated caller context #409 caller/consumer
  context or typed authority from an accepted owning workflow/policy epoch,
  rechecks disclosure immediately before access, and records a bounded,
  coalescible minimized accepted/denied receipt without query, location,
  topology, payload, path, or secret.
• Shared audit persists a replayable minimized envelope or a durable
  policy-governed protected-payload reference before or atomically with live
  acceptance. Audit failure cannot yield a falsely accepted live signal, and a
  live delivery drop remains replayable from durable evidence.

Done when

• Deterministic multi-domain fixtures cover public, protected, and
  unclassified signals with representative location/device/network/OSINT
  identifiers.
• Canonical audit contains only the allowed minimized envelope/reference or
  digest and proves ordered behavior under injected append, partial-write,
  backpressure, restart, and live-consumer-drop failures.
• Authorized reads recover governed protected content; unauthorized export,
  stale/unknown policy, tampering, and cross-persona access fail closed without
  leaking raw values.
• Accepted and denied protected replay/export fixtures prove zero output on
  invalid authority and the bounded receipt shape without a second
  Semaino/interface access-log mechanism.
• No audit failure produces a live accepted signal, and accepted evidence can
  replay or explicitly account for a failed live delivery.
• No hardware is required or authorized by this issue.

Boundary

This issue does not duplicate #378's credential-name audit finding or Phase 07
Pinax content-index policy. It owns the Phase 03 cross-domain signal envelope
behavior and shared audit/export enforcement, while retaining the type and
domain-policy owners above.