feat(portal): add service drawers and employee portal preview

www/reports/phase-10-technical-readiness-package-2026-10-22.md

@@ -64,3 +64,16 @@ P9-01 through P9-10 remain **Pending decision**. No technical feasibility result
 ## Recommended checkpoint boundaries
 
 Keep the existing Phase 9 implementation, audit tooling and reports as one owner-reviewed technical batch. If a signed checkpoint is requested, stage exact paths only after reviewing the final status and reports. Keep any subsequent host rehearsal, Jotform configuration, counter live adapter and measurement work in separately authorized commits.
+
+## 2026-10-30 portal and secrets preparation addendum
+
+The local portal compatibility implementation does not close P9-02 or P9-09.
+The owner must supply legitimate codes privately to collect and classify legacy
+resources, accept the two decrypted views, approve delivery per resource and
+verify server-side staff/management separation. SOPS preparation is an inactive
+[module and operational guide](../integrations/nixos/README.md), not deployed
+infrastructure. Real age recipients, host topology, access policy, recovery and
+runtime key provisioning remain pending. Do not copy `private/` into a release.
+The artifact verifier now rejects private resource paths and portal ciphertext
+from release artifacts. A local ciphertext preview is deliberately not a
+releasable artifact. No site cutover authorization is implied.