🔒 GDPR coverage gate — assertDataProviderCoverage test helper + waivers + boot warn

[PierreBrisorgueil]

The completeness gate — an unregistered PII collection must break CI, not stay silently invisible to export AND erasure. (This is how the previous removal went unnoticed; opt-in registries have no way to prove Art-15/17 coverage.)

Scope

• assertDataProviderCoverage() helper (exported from the users module lib or shared test utils): enumerate mongoose models; any schema with an ObjectId ref to User/Organization (or a declared PII marker) must map to a registered provider key or an explicit waiver entry (allowlist with a one-line justification, e.g. ephemeral no-PII collections, the erasure ledger itself).
• Shipped as: (a) a stack test that FAILS /verify on an unwaived model, (b) a boot-time console warning listing uncovered models.
• A consumer project inherits the test through the standard stack merge — any custom module that adds a user/org-referencing model breaks the consumer's CI until it registers a provider or records a waiver. Coverage stops being tribal knowledge.
• Waiver file format + placement documented in the consumer guide.

DoD

• Test fails on an unwaived user-ref model fixture; passes with provider; passes with waiver.
• Boot warn lists uncovered models (non-fatal at runtime).
• All existing stack models covered or waived (the shipped state is green).
• /verify green.

Depends on: registry leaf v2.

Created via /dev:issue · contract v2 2026-07-03