OCI Organizations API — DomainGovernance resource (Tenant Manager Control Plane).

A DomainGovernance is the governance/ONS-notification configuration
attached to a claimed Domain. Five ops served by `DomainGovernanceClient`,
all synchronous:

- `create-domain-governance` — attach governance to a claimed Domain (200, returns DG)
- `get-domain-governance`    — fetch one DomainGovernance
- `list-domain-governances`  — list in a compartment (paginated, filterable)
- `update-domain-governance` — update subscription email / governance flag / tags (200)
- `delete-domain-governance` — remove governance from a Domain (204, no body)

`list-domain-governances` filters by `domainId`, `domainGovernanceId`,
`lifecycleState` (shared 6-state enum), and `name`, plus standard
`sortBy`/`sortOrder`/`limit`/`page`.

Region routing follows the standard pattern.

OCI Organizations API — Domain resource (Tenant Manager Control Plane).

A Domain represents a domain name registration claimed by a tenancy and
verified via a DNS TXT record. Five ops served by `DomainClient`:

- `create-domain` — begin domain registration (201 + Domain body + workReqId)
- `get-domain`    — fetch a Domain
- `list-domains`  — list Domains in a compartment (paginated, filterable)
- `update-domain` — update tags only (sync; SDK does not surface other mutables)
- `delete-domain` — release the domain (async; the SDK omits the
                    `opc-work-request-id` header on this op, so the wrapper
                    returns `{:data {}}` on acceptance)

`list-domains` filters by `domainId`, `lifecycleState`, `status`, `name`,
plus standard `sortBy`/`sortOrder`/`limit`/`page`. Note the `lifecycleState`
filter uses the *shared* `LifecycleState` enum (6 values) even though the
`Domain` model only ever populates 3 (`Active`/`Deleted`/`Failed`).

Region routing follows the standard pattern.

OCI Organizations API — Governance ops (Tenant Manager Control Plane).

Two opt-in/opt-out actions on an organization's child tenancy, served by
the dedicated `GovernanceClient`:

- `add-governance`    — opt the tenancy in to organization governance rules
- `remove-governance` — opt the tenancy out of organization governance rules

Both are async (202 + `opcWorkRequestId`) and take no body. Path shape is
`/organizations/{organizationId}/tenancies/{organizationTenancyId}/actions/<add|remove>Governance`.

Region routing follows the rest of the Organizations namespace tree —
`(:region opts)` > organization OCID's region segment > singleton default.

OCI Organizations API — Link resource (Tenant Manager Control Plane).

A Link is the parent↔child tenancy relationship inside an organization.
Three ops served by `LinkClient`:

- `get-link`     — fetch one Link
- `list-links`   — list links (paginated, filterable)
- `delete-link`  — start the link termination workflow (async, returns workReqId)

`list-links` filters by parent tenancy, child tenancy, lifecycle state, and
sort order (no `sort-by` on this op).

Region routing follows the standard pattern: `(:region opts)` >
link OCID's region segment > singleton default.

OCI Organizations API — Organization resource (Tenant Manager Control Plane).

Three control-plane ops on the Organization resource itself:

- `get-organization`    — fetch one Organization by OCID
- `list-organizations`  — list Organizations in a compartment (paginated)
- `update-organization` — set `defaultUcmSubscriptionId` (async, returns workReqId)

The Organizations service is regional (43 endpoints). All ops route via
`clients/organization-client-for`, which resolves the region from
`(:region opts)` > the organization OCID's region segment > the singleton
default. ListOrganizations takes a compartment OCID (no region segment) so
it falls back to `:region` opt or the singleton.

Note: `oci/http-request` discards response headers, so this namespace
accepts `:if-match` outbound but cannot surface `etag` or `opc-request-id`
inbound — same limitation as `compute.clj` and `generative_ai.clj`.

OCI Organizations API — OrganizationTenancy resource (Tenant Manager Control Plane).

Six ops on tenancies that belong to an organization, all served by
`OrganizationClient`:

- `list-organization-tenancies`         — list children of an organization (paginated)
- `get-organization-tenancy`            — fetch one OrganizationTenancy
- `approve-organization-tenancy-for-transfer`   — approve a child for transfer (sync, returns OT)
- `unapprove-organization-tenancy-for-transfer` — cancel a transfer approval (sync, returns OT)
- `delete-organization-tenancy`         — start tenancy termination (async, returns workReqId)
- `restore-organization-tenancy`        — restore a deleted tenancy (async, returns workReqId)

Region resolution mirrors the rest of the Organizations namespace tree:
`(:region opts)` > OCID-derived > singleton default.

Note the path-param naming asymmetry across ops: `get-organization-tenancy`
uses `tenancyId` while sibling action ops use `organizationTenancyId` for
what is effectively the same OCID. The wrapper accepts a single
`organization-tenancy-id` string and routes it to whichever Java field the
SDK method actually requires.

Async ops surface `:opcWorkRequestId` in `:data`; the work-request polling
API is not wrapped in this slice.