Retain infrastructure names and share/mount roots behind policy switches

Add a `retain` block to privacy_policy.json (all on by default) so assessments
show software, services, processes, tasks, shares/mounts and private peer IPs.
Values pass an identifier-pattern filter (digit runs, SSN/phone, e-mail, charset,
length, path depth). Accounts, command lines, child paths, filenames and public
peer IPs stay omitted. Linux collector and Windows PowerShell collectors updated;
tests cover retention, withholding and all-switches-off.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

schemas/inventory-v1.schema.json

@@ -539,11 +539,22 @@
           "const": true
         },
         "paths": {
-          "const": "approved-roots-only"
+          "enum": [
+            "approved-roots-only",
+            "share-and-mount-roots-only"
+          ]
         },
         "scope": {
           "type": "string",
           "maxLength": 8192
+        },
+        "retained": {
+          "type": "array",
+          "items": {
+            "type": "string",
+            "maxLength": 64
+          },
+          "maxItems": 20
         }
       }
     }