Governed RAG Foundry

Requirements first. Then architecture, ghosts, a live request trace — and a handoff into the Value Reactor.