Privacy hardening, remote-peer IP masking and review fixes

- Add privacy projection (core/privacy.py), private report storage, bounded
  process capture; omit identities, free text and unapproved paths
- Mask remote peer IPs: only loopback/host/wildcard stay numeric, others are
  reduced to remote_scope private/public (schema + scoring updated)
- Map ss TCP states to canonical names; ASCII-only numeric fields; fix
  "Microsoft Visual C++" product matching (Python and PowerShell)
- Merge 7fed3b9: -Diagnostic switch, serialization exit code 3, PS7 module
  path, UI error detail; keep hardened task/certificate collectors
- Add audit docs, privacy docs and regression tests

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tools/validate_windows_host.py

@@ -8,6 +8,7 @@ import sys
 sys.path.insert(0, str(Path(__file__).resolve().parents[1]))
 from samsara.collectors.windows import collect_local_windows
 from samsara.analyzers.assessment import assess
+from samsara.core.storage import report_directory, require_local_path, write_private
 from samsara.reporting.export import export_html, export_json
 
 
@@ -17,15 +18,17 @@ def main():
     args = parser.parse_args()
     if platform.system() != 'Windows':
         parser.error('Real-host validation requires an authorized local Windows Server execution host.')
-    destination = Path(args.output_dir)
-    if destination.exists():
-        parser.error('Choose a new output directory; existing evidence will not be overwritten.')
+    try:
+        destination = require_local_path(args.output_dir)
+        if destination != report_directory():
+            raise ValueError()
+    except (OSError, ValueError):
+        parser.error('Use the configured private report directory; existing files are never overwritten.')
     try:
         data = collect_local_windows(stage=lambda stage: print(stage, flush=True))
         # collect_local_windows already enforces the supported Server identity and schema.
         if data['synthetic']:
             raise ValueError('A synthetic result cannot be used for real-host validation.')
-        destination.mkdir(parents=True, exist_ok=False)
         assessment = assess(data)
         export_json(destination / 'windows-assessment.json', data, assessment)
         export_html(destination / 'windows-assessment.html', data, assessment)
@@ -40,7 +43,7 @@ def main():
             'counts': {name: len(rows) for name, rows in data['inventory'].items()},
             'review_required': True,
         }
-        (destination / 'validation-summary.json').write_text(json.dumps(summary, indent=2), encoding='utf-8')
+        write_private(destination / 'validation-summary.json',json.dumps(summary,indent=2))
         print(json.dumps(summary, indent=2))
         print('Review partial/failed checks. Keep full inventory/reports private; validation-summary.json omits hostnames, accounts, IPs, paths and certificate identifiers.')
     except (OSError, ValueError, RuntimeError):