Add capability registry with seed entry from reuse-surface

Bootstrap registry layout and migrate helix_forge capability owned by
this repository (REUSE-WP-0014-T02).

registry/README.md

@@ -0,0 +1,12 @@
+# Capability Registry
+
+Markdown-first capability index for federation and reuse planning.
+
+## Authoring
+
+1. Copy a capability entry template (see reuse-surface `templates/capability-entry.template.md`).
+2. Add the row to `indexes/capabilities.yaml`.
+3. Run `reuse-surface validate` from a checkout with the CLI installed.
+4. Merge to `main` and verify publish with `reuse-surface establish --publish-check`.
+
+Federation contract: reuse-surface `docs/RegistryFederation.md`.

registry/capabilities/capability.audit.event-retain.md

@@ -0,0 +1,80 @@
+---
+id: capability.audit.event-retain
+name: Audit Event Retention
+summary: Collect, normalize, retain, and search audit events with integrity evidence across tenants.
+owner: audit-core
+status: draft
+domain: helix_forge
+tags: [audit, retention, compliance]
+
+maturity:
+  discovery:
+    current: D4
+    target: D6
+    confidence: medium
+    rationale: audit-core INTENT defines full audit fabric scope and integration boundaries.
+  availability:
+    current: A2
+    target: A5
+    confidence: low
+    rationale: Core modules exist; deployable service packaging in progress.
+
+external_evidence:
+  completeness:
+    level: C2
+    name: Partial
+    confidence: low
+    basis: scope_vs_intent_and_consumer_expectations
+    satisfied_expectations:
+      - retention and integrity goals documented
+    broken_expectations:
+      - federation with all platform runtimes not proven in registry
+    out_of_scope_expectations:
+      - application business audit semantics ownership
+  reliability:
+    level: R1
+    confidence: low
+    basis: consumer_quality_signals
+    known_reliability_risks:
+      - multi-tenant isolation not evidenced here
+
+discovery:
+  intent: >
+    Provide independent audit fabric for collecting, retaining, searching, and
+    proving integrity of audit events.
+  includes:
+    - audit ingestion
+    - retention policy
+    - search and export
+    - tamper evidence
+  excludes:
+    - generating domain business events
+  use_cases: []
+
+availability:
+  current_level: A2
+  target_level: A5
+  current_artifacts:
+    - audit-core/
+  consumption_modes:
+    - source module
+
+relations:
+  depends_on: []
+  related_to:
+    - capability.activity.event-coordinate
+    - capability.statehub.progress-log
+
+consumer_guidance:
+  recommended_for:
+    - planning audit retention independent of a single product
+  not_recommended_for:
+    - replacing application-level logging only
+  known_limitations:
+    - consumer evidence not yet collected in registry
+---
+
+# Audit Event Retention
+
+Audit Core provides the retention and integrity layer for audit events across
+the platform.

registry/indexes/capabilities.yaml

@@ -0,0 +1,19 @@
+version: 1
+updated: '2026-06-16'
+domain: helix_forge
+capabilities:
+- id: capability.audit.event-retain
+  name: Audit Event Retention
+  summary: Collect, normalize, retain, and search audit events with integrity evidence
+    across tenants.
+  vector: D4 / A2 / C2 / R1
+  domain: helix_forge
+  status: draft
+  owner: audit-core
+  path: registry/capabilities/capability.audit.event-retain.md
+  tags:
+  - audit
+  - retention
+  - compliance
+  consumption_modes:
+  - source module