Privacy hardening, remote-peer IP masking and review fixes

- Add privacy projection (core/privacy.py), private report storage, bounded
  process capture; omit identities, free text and unapproved paths
- Mask remote peer IPs: only loopback/host/wildcard stay numeric, others are
  reduced to remote_scope private/public (schema + scoring updated)
- Map ss TCP states to canonical names; ASCII-only numeric fields; fix
  "Microsoft Visual C++" product matching (Python and PowerShell)
- Merge 7fed3b9: -Diagnostic switch, serialization exit code 3, PS7 module
  path, UI error detail; keep hardened task/certificate collectors
- Add audit docs, privacy docs and regression tests

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

powershell/Get-ServerTasks.ps1

@@ -1,25 +1,18 @@
 function Get-SamsaraTasks {
     param($Result)
-    Invoke-SamsaraRead $Result 'Scheduled tasks' {
-        $tasks = @(Get-ScheduledTask -ErrorAction Stop)
-        foreach ($task in $tasks) {
-          Invoke-SamsaraRead $Result 'Scheduled task metadata projection' {
-            if ($null -eq $task -or [string]::IsNullOrEmpty([string]$task.TaskName)) { throw 'Missing task identity' }
-            $triggers = @($task.Triggers | ForEach-Object {
-                $type = if ($_.CimClass) { [string]$_.CimClass.CimClassName } else { 'Unknown trigger' }
-                # Select only known scheduler metadata; never serialize entire CIM objects.
-                $repetition = if ($_.Repetition) { [string]$_.Repetition.Interval } else { '' }
-                '{0}; start={1}; enabled={2}; daysInterval={3}; weeksInterval={4}; daysOfWeek={5}; repeat={6}' -f $type, $_.StartBoundary, $_.Enabled, $_.DaysInterval, $_.WeeksInterval, $_.DaysOfWeek, $repetition
-            })
-            $executables = @($task.Actions | ForEach-Object { Get-SamsaraSafeExecutable ([string]$_.Execute) })
-            $row = [pscustomobject]@{ name = [string]$task.TaskName; path = [string]$task.TaskPath
-                enabled = [bool]$task.Settings.Enabled; state = [string]$task.State
-                account = if ($task.Principal.UserId) { [string]$task.Principal.UserId } else { [string]$task.Principal.GroupId }; executables = ($executables -join '; ')
-                triggers = if ($triggers.Count) { $triggers -join ' | ' } else { 'No trigger metadata visible; manual or external invocation remains possible' } }
-            $null = ConvertTo-Json -InputObject $row -Depth 4 -ErrorAction Stop
-            $Result.data += $row
-          }
-        }
+    Invoke-SamsaraRead $Result 'Minimal scheduler metadata' {
+        $index = 0
+        $Result.data = @(Get-CimInstance -Namespace 'Root/Microsoft/Windows/TaskScheduler' -ClassName MSFT_ScheduledTask -Property TaskName,TaskPath,State -ErrorAction Stop | ForEach-Object {
+            $index++
+            $routine = ([string]$_.TaskPath).StartsWith('\Microsoft\Windows\', [StringComparison]::OrdinalIgnoreCase) -and
+                -not ([string]$_.TaskPath).StartsWith('\Microsoft\Windows\PowerShell\ScheduledJobs', [StringComparison]::OrdinalIgnoreCase)
+            $state = switch ([int]$_.State) { 1 {'Disabled'} 2 {'Queued'} 3 {'Ready'} 4 {'Running'} default {'Unknown'} }
+            [pscustomobject]@{ name = $(if ($routine) { 'Maintenance-' + $index } else { 'Task-' + $index })
+                path = $(if ($routine) { '\Microsoft\Windows\Maintenance\' } else { 'Task folder omitted' })
+                enabled = ([int]$_.State -in @(2,3,4)); state = $state
+                account = 'Omitted by privacy policy'; triggers = 'Schedule details omitted; authorized scheduler review required.' }
+        })
     }
-    $Result.limitations += 'Visible Task Scheduler registrations only. Arguments, inline scripts, task XML, event queries and execution history are omitted. Non-executable actions may lack an executable name. Trigger fields are descriptive, not a prediction of execution.'
+    $Result.status = 'partial'
+    $Result.limitations += 'Only projected task identity/category and state requested. Actions, arguments, principals, triggers and task XML are not requested. Schedule timing and actual execution remain unverified. Provider internals remain outside application guarantees.'
 }