Native privacy composition (CORE-60)

Pass privacy=service to create_kernel_agent_router(host, ...) to select PrivacyService for GET /tenants/me/export and DELETE /tenants/me/data (under the configured prefix). With this option, graph export and memory forget routes are replaced; unrelated graph and memory routes remain mounted. Omitting it preserves existing routing.

Compose the service with an explicit SubjectDataStoreRegistry, erasure fence, saga store, and acknowledged audit sink through AuditSeam. Register each deployment store that must export and erase subject data: transcripts, checkpoints, memory, graph, or other stores need their own participant adapters. The registry is the inventory of covered stores; this option discovers none.

Supply a HeaderScopeResolver(verifier=...) as scope_resolver. Custom resolvers must return AuthenticatedPrincipal with derivation={"verified": True} after authenticating credentials and authorizing the requested tenant. A missing resolver, unverified principal, or mismatched tenant fails closed. No additional admin role is required by this service.

Erasure requires ?confirmation=DELETE-<tenant_id> matching the resolved tenant. The service acknowledges destructive audit intent before publishing a tombstone and running the participant saga. The response reports complete, counts, and unconfirmed, plus scope_key, generation, and erased_at. Internal participant diagnostic errors are excluded from the HTTP response. Incomplete erasure must be resumed through the service by the deployment. Export returns the service's versioned participant fragments; erased subjects receive 410 and reads during incomplete erasure receive 409.

Route composition alone does not fence all writers or guard host turns. Couple host admission to SubjectGuard.require_admission (for example through AdmissionGate(guard=...)) and store reads to SubjectGuard.require_readable, using the same fence and saga store as the service. Writers must commit through the same fence's generation-checked conditional-write port. This includes background jobs and in-flight writes. Other memory/graph read routes need that guard in their composed services. This opt-in service mapping is not evidence of legacy wire parity, complete cutover, fallback unreachability, or retirement.