fix(secondbrain-notes): honor declared privacy_tier frontmatter to block promotion

[levineam]

Motivation

• The capture flow persisted a caller-supplied privacy_tier into note frontmatter but downstream sensitivity logic ignored that field, allowing private/sensitive/secret captures to be queued and promoted erroneously.
• The change restores the intended privacy contract so explicitly-declared privacy tiers prevent downstream promotion and generation of derived wiki/memory artifacts.

Description

• Updated sensitivityFor in packages/jarvos-secondbrain-notes/src/knowledge-optimizer.js to read and normalize frontmatter.privacy_tier into a recognized privacyTier value and prefer it when deciding artifact privacy.
• When privacy_tier is private, sensitive, or secret the heuristic now records an exclusion reason and ensures privacyTier is propagated instead of defaulting to local-private.
• Added a regression test in modules/jarvos-secondbrain/tests/knowledge-units.test.js that asserts private, sensitive, and secret frontmatter tiers set artifact privacyTier, mark sensitivity.excluded, and skip both GBrain and memory-wiki promotion.

Testing

• Ran node --test tests/knowledge-units.test.js and the test file (including the new regression) passed (4 tests, 0 failures).
• Ran the package test suite via npm test which reported 415 of 418 tests passing and the three failing tests are pre-existing/unrelated to this change (two in coding-tool-determinism-docs.test.js and one in journal-note-audit.test.js).
• Verified the modified sensitivityFor behavior produces privacyTier values and causes gbrain/memoryWiki statuses to be skipped for declared private tiers in automated unit tests.

---

Codex Task