Enterprise guardrails: add DLP and deterministic redaction policies

[tcballard]

Why

Organizations need bounded controls over sensitive data without turning the routing decision into an opaque model call.

Scope

• Add versioned allow, block, redact, warn, and log policy actions.
• Implement deterministic rules for approved structured identifiers and secrets.
• Define pre-delivery and post-response enforcement points.
• Make transformations visible in receipts and audit metadata without logging sensitive values.
• Provide an extension contract for separately governed external scanners.
• Bound inspection size, latency, and failure behaviour.

Acceptance criteria

• Policy evaluation is deterministic for the same versioned input and configuration.
• Redacted values never enter provider payloads or ordinary telemetry.
• Scanner failure follows an explicit fail-open or fail-closed workspace policy.
• Streaming cannot leak content before a blocking policy decision.
• Tests cover encoding, fragmentation, false positives, cancellation, and bypass attempts.

Parent: #146

Invariant

The scored model decision remains offline, deterministic, keyless, and explainable.