fix(privacy): add value-blind public source gate

[verlyn13]

Summary

Add a value-blind privacy gate for this public repository and remove private identity details from current operational authority where they are not required.

• Adds a repository-owned public privacy policy and deterministic scanner.
• Adds isolated synthetic fixtures covering public/static and optional private-denylist behavior.
• Runs the privacy suite and production scan from the repository's existing CI gate.
• Keeps private identity values outside repository source, policy, fixtures, and diagnostics.
• Classifies narrowly retained historical, byte-pinned, and runtime-bound references rather than using broad exclusions.
• Replaces the Google administration snapshot with an operator-gated, value-blind operational contract.

Validation

• scripts/validate-repo.sh passes in the CI-shaped non-TTY execution environment.
• Public privacy suite: 15 passed, 0 failed.
• System-update suite: 156 passed, 0 failed in the CI-shaped run.
• git diff --check passes.
• Commit has a valid SSH signature.
• Successor worktree is clean.

External / optional checks

The public gate does not claim knowledge it does not possess.

Optional private-denylist validation, root-policy linkage, and the producer differential remain explicitly not_run unless their operator-controlled external inputs are supplied.

Scope

This PR does not:

• rewrite Git history;
• migrate the OpenBao SSH host configuration;
• perform historical-record sanitization;
• activate or query live providers;
• apply chezmoi;
• synchronize MCP configuration;
• access 1Password or Keychain values.

Those concerns remain separate.