Privacy hardening, remote-peer IP masking and review fixes

- Add privacy projection (core/privacy.py), private report storage, bounded
  process capture; omit identities, free text and unapproved paths
- Mask remote peer IPs: only loopback/host/wildcard stay numeric, others are
  reduced to remote_scope private/public (schema + scoring updated)
- Map ss TCP states to canonical names; ASCII-only numeric fields; fix
  "Microsoft Visual C++" product matching (Python and PowerShell)
- Merge 7fed3b9: -Diagnostic switch, serialization exit code 3, PS7 module
  path, UI error detail; keep hardened task/certificate collectors
- Add audit docs, privacy docs and regression tests

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/test_import.py

@@ -23,7 +23,7 @@ class ImportTests(unittest.TestCase):
         data = self.load(collect_demo(LINUX_DEMO_HOST))
         self.assertEqual(data['server']['platform'], 'linux')
         result = assess(data)
-        self.assertTrue(any('/srv/reports' in item['evidence'] for item in result['findings']))
+        self.assertTrue(any('Share-' in item['evidence'] for item in result['findings']))
         self.assertTrue(any('certificates:' in item['evidence'] for item in result['findings']))
 
     def test_report_wrapper_recomputed_and_sensitive_fields_removed(self):