Privacy hardening, remote-peer IP masking and review fixes

- Add privacy projection (core/privacy.py), private report storage, bounded
  process capture; omit identities, free text and unapproved paths
- Mask remote peer IPs: only loopback/host/wildcard stay numeric, others are
  reduced to remote_scope private/public (schema + scoring updated)
- Map ss TCP states to canonical names; ASCII-only numeric fields; fix
  "Microsoft Visual C++" product matching (Python and PowerShell)
- Merge 7fed3b9: -Diagnostic switch, serialization exit code 3, PS7 module
  path, UI error detail; keep hardened task/certificate collectors
- Add audit docs, privacy docs and regression tests

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

powershell/Get-ServerCertificates.ps1

@@ -1,28 +1,6 @@
 function Get-SamsaraCertificates {
     param($Result)
-    $collection = @{ stores = @() }
-    Invoke-SamsaraRead $Result 'Local machine certificate store list' {
-        $collection.stores = @(Get-ChildItem -LiteralPath 'Cert:\LocalMachine' -ErrorAction Stop)
-    }
-    # Listing store names is not evidence that any listed store was readable.
-    if ($collection.stores.Count -gt 0) { $Result.successful_subchecks-- }
-    foreach ($store in $collection.stores) {
-        # Certificate provider PSPath may omit LocalMachine (including on 5.1).
-        # Construct an explicit provider path from the enumerated store name.
-        $storeName = [string]$store.PSChildName
-        Invoke-SamsaraRead $Result 'Certificate store query' {
-            if ($storeName -notmatch '^[A-Za-z0-9_. -]+$') { throw 'Invalid store name' }
-            $certificates = @(Get-ChildItem -LiteralPath ('Cert:\LocalMachine\' + $storeName) -ErrorAction Stop)
-            foreach ($certificate in $certificates) {
-                Invoke-SamsaraRead $Result 'Certificate metadata projection' {
-                $row = [pscustomobject]@{ subject = [string]$certificate.Subject; issuer = [string]$certificate.Issuer
-                    expires = $certificate.NotAfter.ToUniversalTime().ToString('o'); thumbprint = [string]$certificate.Thumbprint
-                    store = $storeName }
-                $null = ConvertTo-Json -InputObject $row -Depth 4 -ErrorAction Stop
-                $Result.data += $row
-                }
-            }
-        }
-    }
-    $Result.limitations += 'Public LocalMachine certificate metadata only. Private keys, password-protected files, CurrentUser stores, application bindings and off-store certificates are not read.'
+    $Result.status = 'not_collected'
+    $Result.message = 'Certificate enumeration disabled by privacy policy.'
+    $Result.limitations += 'Subjects, issuers, extensions and certificate objects may contain identifying information. Use a separately approved certificate review; no certificate provider is invoked.'
 }