Every issuer declared for the whole deployment, whether it is currently in the
trust set or switched off.

The disabled ones are included deliberately. A configuration surface that showed only what is live would hide a row from the operator who disabled it, and there would be no way back to it.

Only the deployment's own declarations appear. A tenant's own issuers are on the tenant plane and are not readable here — the platform token is the most privileged on the deployment, and this surface still must not become a way to read every customer's registry.

Ordered by canonical issuer URL, so the list is stable across calls rather than dependent on what the database happened to return.

Never entitlement-gated. No Edition widens or narrows this plane. These are

the deployment operator's own declarations rather than a tenant's, so there is no
Edition to consult (FR-181.16).