Privacy hardening, remote-peer IP masking and review fixes

- Add privacy projection (core/privacy.py), private report storage, bounded
  process capture; omit identities, free text and unapproved paths
- Mask remote peer IPs: only loopback/host/wildcard stay numeric, others are
  reduced to remote_scope private/public (schema + scoring updated)
- Map ss TCP states to canonical names; ASCII-only numeric fields; fix
  "Microsoft Visual C++" product matching (Python and PowerShell)
- Merge 7fed3b9: -Diagnostic switch, serialization exit code 3, PS7 module
  path, UI error detail; keep hardened task/certificate collectors
- Add audit docs, privacy docs and regression tests

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

powershell/Get-ServerSystem.ps1

@@ -1,19 +1,21 @@
 function Get-SamsaraSystem {
     param($Result)
     $Result.data = [ordered]@{
-        hostname = [Environment]::MachineName; platform = 'windows'
+        hostname = 'Host-0001'; platform = 'windows'
         collection_source = 'Local Windows read-only collection'
         operating_system = 'Not collected'; os_version = 'Not collected'; os_build = 'Not collected'
         product_type = 0; last_boot = 'Not collected'; ip_addresses = @(); network_adapters = @()
         domain = 'Not collected'; domain_joined = $null
     }
+    Get-SamsaraPrivacyConfiguration
+    if ($script:SamsaraPrivacy.approved_hostnames -ccontains [Environment]::MachineName) { $Result.data.hostname = [Environment]::MachineName }
     Invoke-SamsaraRead $Result 'OS identity' {
-        $os = Get-CimInstance -ClassName Win32_OperatingSystem -Property Caption,Version,BuildNumber,LastBootUpTime,ProductType -ErrorAction Stop
+        $os = Get-CimInstance -ClassName Win32_OperatingSystem -Property Version,BuildNumber,LastBootUpTime,ProductType -ErrorAction Stop
         $years = @{ '14393' = '2016'; '17763' = '2019'; '20348' = '2022'; '26100' = '2025' }
         if ([int]$os.ProductType -notin @(2,3) -or -not $years.ContainsKey([string]$os.BuildNumber)) {
             throw 'Unsupported Windows release or workstation edition.'
         }
-        $Result.data.operating_system = [string]$os.Caption
+        $Result.data.operating_system = 'Windows Server ' + $years[[string]$os.BuildNumber]
         $Result.data.os_version = $years[[string]$os.BuildNumber]
         $Result.data.os_build = [string]$os.BuildNumber
         $Result.data.kernel_version = [string]$os.Version
@@ -21,13 +23,13 @@ function Get-SamsaraSystem {
         $Result.data.last_boot = $os.LastBootUpTime.ToUniversalTime().ToString('o')
     }
     Invoke-SamsaraRead $Result 'Computer domain membership' {
-        $computer = Get-CimInstance -ClassName Win32_ComputerSystem -Property Domain,PartOfDomain -ErrorAction Stop
-        $Result.data.domain = [string]$computer.Domain
+        $computer = Get-CimInstance -ClassName Win32_ComputerSystem -Property PartOfDomain -ErrorAction Stop
+        $Result.data.domain = 'Domain identity omitted'
         $Result.data.domain_joined = [bool]$computer.PartOfDomain
     }
     Invoke-SamsaraRead $Result 'Network adapter configuration' {
-        $adapters = @(Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration -Filter 'IPEnabled = True' -Property Description,IPAddress -ErrorAction Stop)
-        $Result.data.network_adapters = @($adapters | ForEach-Object { [string]$_.Description })
+        $adapters = @(Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration -Filter 'IPEnabled = True' -Property IPAddress -ErrorAction Stop)
+        $Result.data.network_adapters = @($adapters | ForEach-Object -Begin { $i = 0 } -Process { $i++; 'Adapter-' + $i })
         $Result.data.ip_addresses = @($adapters | ForEach-Object { foreach ($address in $_.IPAddress) { [string]$address } })
     }
     $Result.limitations += 'Identity and addresses are local observations. No DNS probes or Active Directory enrichment were performed.'