Retain infrastructure names and share/mount roots behind policy switches

Add a `retain` block to privacy_policy.json (all on by default) so assessments
show software, services, processes, tasks, shares/mounts and private peer IPs.
Values pass an identifier-pattern filter (digit runs, SSN/phone, e-mail, charset,
length, path depth). Accounts, command lines, child paths, filenames and public
peer IPs stay omitted. Linux collector and Windows PowerShell collectors updated;
tests cover retention, withholding and all-switches-off.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

tests/powershell/Test-Collectors.ps1

@@ -10,6 +10,9 @@ foreach ($file in $files) {
 }
 foreach ($file in @($files | Where-Object { $_.Name -ne 'Get-ServerInventory.ps1' })) { . $file.FullName }
 $script:SamsaraIsElevated = $true
+# Synthetic SECRET canaries must never serialize: run these contract tests with every `retain` switch off.
+Get-SamsaraPrivacyConfiguration
+foreach ($property in @($script:SamsaraPrivacy.retain.PSObject.Properties)) { $property.Value = $false }
 $script:SyntheticBuild = '20348'
 function Get-CimInstance {
     [CmdletBinding()] param($ClassName, $Property, $Filter, $Namespace)