[T-076] The cache's operational envelope is unenforced — schema version, disk footprint, permissions, scaling assumptions

[Ztein]

Canonical ticket: docs/tickets/T-076-cache-operational-envelope-unenforced.md

No schema version (mitigated at open-time by T-072's quarantine — scorecard row E1 passes; post-open mismatches remain), on-disk footprint exceeds max_size_mb and never shrinks (E3), cache dir/db created with default umask despite holding cleartext document content (E2), single-host/local-disk assumptions undocumented. Measured by scorecard rows E1–E3.