Privacy hardening, remote-peer IP masking and review fixes

- Add privacy projection (core/privacy.py), private report storage, bounded
  process capture; omit identities, free text and unapproved paths
- Mask remote peer IPs: only loopback/host/wildcard stay numeric, others are
  reduced to remote_scope private/public (schema + scoring updated)
- Map ss TCP states to canonical names; ASCII-only numeric fields; fix
  "Microsoft Visual C++" product matching (Python and PowerShell)
- Merge 7fed3b9: -Diagnostic switch, serialization exit code 3, PS7 module
  path, UI error detail; keep hardened task/certificate collectors
- Add audit docs, privacy docs and regression tests

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

powershell/Get-ServerSoftware.ps1

@@ -5,11 +5,12 @@ function Read-SamsaraSoftwareEntries {
         try {
             $entry = $Uninstall.OpenSubKey($name, $false)
             if ($null -eq $entry) { throw 'Software entry not readable.' }
-            $display = [string]$entry.GetValue('DisplayName')
+            $display = [string]$entry.GetValue('DisplayName', $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
             if ($display) {
-                $Result.data += [pscustomobject]@{ name = $display; publisher = [string]$entry.GetValue('Publisher')
-                    version = [string]$entry.GetValue('DisplayVersion'); installation_date = [string]$entry.GetValue('InstallDate')
-                    registry_view = $View }
+                $version = [string]$entry.GetValue('DisplayVersion', $null, [Microsoft.Win32.RegistryValueOptions]::DoNotExpandEnvironmentNames)
+                if ($version -match '^(\d{1,5}(?:\.\d{1,5}){0,3})(?![\d.])') { $version = $Matches[1] } else { $version = 'Not collected' }
+                $Result.data += [pscustomobject]@{ name = Get-SamsaraPublicName 'products' $display ($Result.data.Count + 1)
+                    version = $version; registry_view = $View }
             }
         } catch { Add-SamsaraError $Result $_ 'Machine software entry' }
         finally { if ($entry) { $entry.Dispose() } }
@@ -33,5 +34,5 @@ function Get-SamsaraSoftware {
             }
         }
     }
-    $Result.limitations += 'Machine uninstall registrations in both registry views only. Per-user, portable, container and unregistered software may be absent. Install dates are raw registry values and may be empty. No installer consistency checks are triggered.'
+    $Result.limitations += 'Machine uninstall registrations in both registry views only. Per-user, portable, container and unregistered software may be absent. Publisher, installation date, uninstall commands and environment expansion are omitted. No installer consistency checks are triggered.'
 }