Wavelynx — trust boundaries

Every place a Wavelynx-issued credential's data crosses an organizational trust boundary, and what cryptographic protection wraps each crossing. Internal-to-Wavelynx links (e.g. application tier to Cloud SQL via Unix socket) are not crossings — Wavelynx controls both ends. KMS appears as a distinct zone because Cloud KMS is the only authority that can produce plaintext keysets; Wavelynx delegates that trust to Google.