Retain infrastructure names and share/mount roots behind policy switches

Add a `retain` block to privacy_policy.json (all on by default) so assessments
show software, services, processes, tasks, shares/mounts and private peer IPs.
Values pass an identifier-pattern filter (digit runs, SSN/phone, e-mail, charset,
length, path depth). Accounts, command lines, child paths, filenames and public
peer IPs stay omitted. Linux collector and Windows PowerShell collectors updated;
tests cover retention, withholding and all-switches-off.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

docs/PRIVACY_HARDENING.md

@@ -54,6 +54,28 @@ Do not replace their findings with an unsupported claim that all issues are reso
   `public`, because client IPs on patient-facing servers can be identifiers. Local
   listener addresses and the host's own IPs are still retained.
 
+## What is retained (the `retain` policy block)
+
+Assessments are only useful if they name the software, services and storage a server
+depends on, so `privacy_policy.json` has a `retain` block of switches, all `true` by default:
+
+| Switch | Keeps | Always omitted |
+| --- | --- | --- |
+| `hostname` | server hostname | domain name |
+| `software_names` | installed product/package name, numeric version | publisher, install dates, uninstall commands |
+| `service_names`, `process_names` | service, role and connection-process names | accounts, descriptions, executable paths and arguments |
+| `task_names` | scheduled task name and task folder | actions, arguments, principals, triggers |
+| `storage_names_and_roots` | share/export names, share and mount **root** paths, NFS/SMB mount sources | child paths, filenames, file contents, open files, sessions |
+| `private_peer_addresses` | RFC 1918 / link-local peer IPs | public peer IPs (always reduced to `remote_scope: public`) |
+
+Every retained value must pass a pattern filter: ASCII only, no 6+ digit runs (MRN-like),
+no SSN or phone patterns, no e-mail addresses, at most 120 characters, and paths of at
+most four components with no traversal. Failing values fall back to numbered labels
+(`Software-0007`). **This is a heuristic, not PHI detection**: a name that embeds a
+patient's name would pass. Collectors only request roots, but an imported file with deeper
+paths is limited only by the four-component rule. Set a switch to `false` for any category
+CHS does not approve; each switch is independent and the tests cover the all-off profile.
+
 ## Configure approved metadata and report storage
 
 Deployment administrators review and protect these bundled files against untrusted