feat: add stable sanitized snapshot exports

[fly1d]

Summary

• add allowlist-based HMAC-SHA256 pseudonymization for diagnostic snapshots
• support both sanitize and collect --sanitize with environment-only keys
• preserve cross-snapshot object relationships while removing direct identifiers, queue arguments, scenarios, and unknown fields
• mark sanitized uploads in the local workbench and document the privacy threat model
• release the behavior as 0.3.0

Product reason

Paid-pilot prospects may not be allowed to share production cluster, node, vhost, queue, user, client, or network identifiers. Stable local pseudonyms let the same customer compare a baseline and retest without sending those identifiers to the operator.

Risk and security review

This is a customer-data change and is treated as high risk.

• output is constructed from an explicit field allowlist
• keys are read only from a named environment variable and require at least 16 UTF-8 bytes
• identifiers use category-separated HMAC-SHA256 pseudonyms
• malformed enums, timestamps, booleans, numeric values, and relationship lists are normalized without copying attacker-controlled fields
• missing keys fail before Management API collection starts
• already-sanitized inputs are rejected to avoid breaking stable relationships
• no key, key fingerprint, queue arguments, scenario metadata, or unknown input field is written
• timestamps, workload sizes, rates, topology counts, and cross-run linkability remain sensitive; this is pseudonymization, not anonymity

Threat model and delivery checklist: docs/PRIVACY.md.

Verification

• make verify (23 tests, compileall, browser JavaScript syntax)
• make smoke
• git diff --check
• desktop browser QA at 1440x900: sanitized upload, badge, v0.3.0, quorum finding, no overlap or horizontal overflow
• mobile browser QA at 390x844: no overflow elements, no title/badge overlap, no console warnings or errors

Review focus

• identifier coverage and relationship preservation in sanitizer.py
• malformed-input behavior and absence of accidental field copying
• CLI failure order for collect --sanitize
• privacy limitations and wording in docs/PRIVACY.md

Rollback

Revert this PR. Existing raw snapshot collection, diagnosis, history, and reports do not require a data migration.

[fly1d]

Security-focused code review completed.

No blocking findings.

Reviewed:

• allowlist output construction and identifier coverage
• HMAC domain separation and stable node/quorum relationships
• environment-only key handling and minimum length validation
• failure order before Management API collection
• malformed enum, timestamp, boolean, metric, and relationship inputs
• duplicate-sanitization rejection and absence of key-derived verifier metadata
• workbench labeling versus actual guarantees
• threat model, residual sensitivity, and rollback path

Verification evidence: 23 local tests, compileall, JavaScript syntax check, product smoke test, passing Python 3.9/3.12 and smoke CI, plus desktop/mobile upload QA with no overflow, overlap, or console errors.

Residual risk is documented and accepted for this local paid-pilot scope: stable pseudonyms remain linkable, and timestamps, rates, workload sizes, resource values, and topology counts remain sensitive. This output is pseudonymized, not anonymous.