Sync security, retention, and release evidence

[abrichr]

Summary

• replace stale library-only encryption instructions with the shipped openadapt flow seal path across onboarding, deployment, regulated-execution, and configuration docs
• document the hosted retention/legal-hold/tenant-erasure contract and the complete DB + private-Storage scratch-restore gate without implying provider PITR or a backup SLA
• update hosted readiness from the retained Flow 1.8 recorder qualification to the currently deployed Flow 1.23 identity and live dependency contract
• publish the exact Desktop 0.12.1 checksum, CycloneDX SBOM, and provenance boundary while keeping native publisher signing as an external credential gate
• consolidate the remaining external assurance gates: policy adoption/tabletop, counsel-reviewed DPA/BAA/PHIPA terms, signing identities, and independent SOC 2 work

Verification

• UV_CACHE_DIR=/tmp/uv-cache-openadapt-ops uv run pytest -q — 76 passed
• UV_CACHE_DIR=/tmp/uv-cache-openadapt-ops uv run mkdocs build --strict --site-dir /private/tmp/openadapt-ops-security-sync-site — passed
• git diff --check — passed
• independently verified the public desktop-v0.12.1 release tag, release workflow, SHA256SUMS, CycloneDX asset, and a GitHub attestation for a published installer digest
• independently read the live production readiness endpoint and merged Cloud restore contract PR #148

The account-level GitHub Actions payment/spending condition may prevent new hosted jobs from starting; the local exact-head verification above is complete.