Risk Governance in Cross-Chain: Minimal Trust Assumptions and Transparent Controls