fix(privacy): close historical evidence exemptions

[verlyn13]

Summary

Remove whole-file privacy exemptions for historical documents and preserve historical provenance using public-safe evidence instead.

• Historical classification no longer suppresses privacy rules.
• Sanitizes incidental private source locators in mixed historical/current records.
• Preserves ownership, logical repository/document identity, immutable commit/date provenance, and explicit redaction where needed.
• Retains narrow separately governed runtime and byte-pinned exceptions.
• Strengthens the validator so a historical classification carrying exemptions is rejected.

Why

A dated filename is not an authority boundary. Historical records in this repository also contain current-state notes, routing instructions, recommendations, commands, and later operational addenda.

Historical provenance should preserve the claim, not create a whole-file privacy bypass.

Validation

• Public privacy suite: 18 passed, 0 failed.
• Production public privacy scan: PASS.
• System-update suite: 156 passed, 0 failed in the CI-shaped run.
• Full scripts/validate-repo.sh: PASS.
• git diff --check: PASS.
• Commit has a valid SSH signature.
• Successor worktree is clean.

External / optional checks

The operator-owned private-dictionary lane was not configured and therefore is not claimed as having run.

Scope

This PR does not:

• rewrite Git history;
• modify OpenBao SSH/machine-data configuration;
• alter iTerm2/runtime identifiers;
• modify byte-pinned HCS material;
• change signing identities;
• fix the separate direct-TTY width issue;
• perform provider, Keychain, 1Password, chezmoi-apply, or live-host operations.