Privacy hardening, remote-peer IP masking and review fixes

- Add privacy projection (core/privacy.py), private report storage, bounded
  process capture; omit identities, free text and unapproved paths
- Mask remote peer IPs: only loopback/host/wildcard stay numeric, others are
  reduced to remote_scope private/public (schema + scoring updated)
- Map ss TCP states to canonical names; ASCII-only numeric fields; fix
  "Microsoft Visual C++" product matching (Python and PowerShell)
- Merge 7fed3b9: -Diagnostic switch, serialization exit code 3, PS7 module
  path, UI error detail; keep hardened task/certificate collectors
- Add audit docs, privacy docs and regression tests

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/test_scoring.py

@@ -7,7 +7,7 @@ from samsara.analyzers.assessment import assess
 from samsara.analyzers.dependencies import CONFIRMED, POTENTIAL, STANDARD, UNKNOWN
 from samsara.analyzers.policy import load_policy
 from samsara.models.inventory import validate_inventory
-from samsara.reporting.export import export_html, export_json
+from report_helpers import export_html, export_json
 from samsara.collectors.importer import load_inventory
 
 
@@ -191,15 +191,14 @@ class ScoringRegressionTests(unittest.TestCase):
             self.assertIn('Historical usage validation',text)
             self.assertNotIn('medium-risk dependencies',text)
             self.assertLess(text.count('<tr>'),60)
-            inventory=list(Path(folder).glob('*.inventory-*.json'))
-            self.assertEqual(len(inventory),1)
-            raw=json.loads(inventory[0].read_text())
-            self.assertEqual(raw,data)
-            self.assertEqual(len(raw['inventory']['services']),86)
-            # Re-export reuses an identical artifact rather than losing inventory.
-            export_html(report,data,assess(data))
-            export_json(Path(folder)/'assessment.json',data,assess(data))
-            self.assertEqual(load_inventory(inventory[0])['inventory'],load_inventory(Path(folder)/'assessment.json')['inventory'])
+            self.assertEqual(list(Path(folder).glob('*.inventory-*.json')),[])
+            with self.assertRaises(FileExistsError):
+                export_html(report,data,assess(data))
+            output=Path(folder)/'assessment.json'
+            export_json(output,data,assess(data))
+            clean=load_inventory(output)
+            self.assertEqual(len(clean['inventory']['services']),86)
+            self.assertNotEqual(clean['server']['hostname'], data['server']['hostname'])
 
     def test_custom_jobs_not_misclassified_by_substrings_and_zero_points_maintenance(self):
         data=fixture('clean_windows')
@@ -218,9 +217,7 @@ class ScoringRegressionTests(unittest.TestCase):
             report=Path(folder)/'assessment.html'
             export_html(report,data,result)
             self.assertNotIn('<script>',report.read_text())
-            self.assertIn('&lt;script&gt;',report.read_text())
-            artifact=next(Path(folder).glob('*.inventory-*.json'))
-            artifact.write_text('unrelated data')
+            self.assertNotIn('owned',report.read_text())
+            self.assertEqual(list(Path(folder).glob('*.inventory-*.json')),[])
             with self.assertRaises(FileExistsError):
                 export_html(report,data,result)
-            self.assertEqual(artifact.read_text(),'unrelated data')