Privacy hardening, remote-peer IP masking and review fixes

- Add privacy projection (core/privacy.py), private report storage, bounded
  process capture; omit identities, free text and unapproved paths
- Mask remote peer IPs: only loopback/host/wildcard stay numeric, others are
  reduced to remote_scope private/public (schema + scoring updated)
- Map ss TCP states to canonical names; ASCII-only numeric fields; fix
  "Microsoft Visual C++" product matching (Python and PowerShell)
- Merge 7fed3b9: -Diagnostic switch, serialization exit code 3, PS7 module
  path, UI error detail; keep hardened task/certificate collectors
- Add audit docs, privacy docs and regression tests

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/report_helpers.py

@@ -0,0 +1,14 @@
+"""Authorize a private temporary root for legacy report rendering tests only."""
+from pathlib import Path
+from unittest.mock import patch
+from samsara.reporting.export import export_html as _html, export_json as _json
+
+
+def export_html(path, data, assessment):
+    with patch('samsara.core.storage._verify_windows_acl'), patch('samsara.core.storage.report_directory',return_value=Path(path).parent):
+        return _html(path,data,assessment)
+
+
+def export_json(path, data, assessment):
+    with patch('samsara.core.storage._verify_windows_acl'), patch('samsara.core.storage.report_directory',return_value=Path(path).parent):
+        return _json(path,data,assessment)