Phase 0 milestone 0.7: retention scaffold

Every mapped table resolves a retention policy; a report-only job runs
over all of them and logs "N records to purge". ARCH §6.4; NIST AU-11,
SI-12; source RFP C.5.7.42.

- framework/retention.py: RetentionPolicy (data class, disposal, period,
  anchor column, cadence, approved, authority), run_retention(), and a
  `python -m ypms.framework.retention` entrypoint. Phase 0 never mutates
  data: interim-period rows are counted (interim_eligible), approved-period
  rows are counted (to_purge), nothing is purged. One retention_run audit
  row per run.
- retention_classes.py: PIA §9 data classes at their interim periods, all
  approved=False pending YPMS-POAM-054. Classes without a PIA basis
  (hosts, operational logs, accounts, consent-derived) are unset and logged
  by name with their governing POA&M item. Vendored framework tables are
  mapped by table name so vendored files stay unchanged.
- stub_models.py + migration 0004: id + mixin models for the 26 stub
  entities so each can carry a policy. Migration uses a literal table list.
- ypms/models.py: single import-all module used by Alembic env, the job,
  and the test fixtures.
- Drift guard: test upgrades a scratch SQLite DB to head and compares to
  Base.metadata. Found pre-existing drift in 0002 (named unique
  constraints duplicating the unique indexes on roles.code, users.username,
  users.email); allow-listed, follow-up noted in PHASE0_STATUS.

156 tests passing; ruff + mypy clean.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

migrations/env.py

@@ -1,7 +1,7 @@
 """Alembic environment.
 
 Model modules are imported here so `Base.metadata` is populated before Alembic
-compares against it. Add every new model module to the import block below.
+compares against it. New model modules go in `src/ypms/models.py`, not here.
 """
 
 from __future__ import annotations
@@ -14,12 +14,8 @@ from sqlalchemy import engine_from_config, pool
 from ypms.db import Base
 from ypms.settings import get_settings
 
-# ---- Import model modules here so Base.metadata is populated ----
-import ypms.users.models  # noqa: F401
-import ypms.security.models  # noqa: F401
-import ypms.audit.models  # noqa: F401
-import ypms.framework.version_history  # noqa: F401
-import ypms.youth.models  # noqa: F401
+# ---- Populate Base.metadata ----
+import ypms.models  # noqa: F401 — every model module; see src/ypms/models.py
 
 config = context.config
 if config.config_file_name is not None: