Decide archived-PII retention/redaction policy (fleet)

Elazar deferred 2026-07-17 ('for when we get to it'). DECISION PENDING: retention/redaction policy for PII held in *Archive tables. Context: every *Archive twin ALREADY permanently duplicates PII on all 3 apps today (e.g. usersArchive holds emails+names), and NO app has any retention/redaction policy - EVO-57 adds more of the same shape. Options: (a) time-boxed retention - archived PII auto-purges after N days (90/180/365); (b) redact-on-archive - copy row but null/hash PII cols, keep who/when/what-action; (c) no PII in twins - archive non-PII skeleton + reference id only; (d) indefinite full-PII copies = the DE-FACTO STATUS QUO running now, defensible for single-operator private repos, zero-work; (e) other. NOT blocking EVO-57 execution - the twins operate under (d) today regardless; this is a future policy overlay. Revisit if GDPR-style right-to-erasure hygiene is ever wanted.