feat: add public dataset disclosure-risk and safe-output policy

[edithatogo]

Summary

Add a reusable disclosure-risk and safe-output policy for public clinical dataset examples so local worked-example outputs do not accidentally become publishable patient-level extracts.

Linked Conductor track

conductor/tracks/public_clinical_dataset_worked_example_20260704

Why this is separate

The MIMIC-IV Demo worked example must avoid committing raw files and should keep local outputs safe, but reusable disclosure-risk rules affect all future public-dataset examples and browser/docs workflows.

Acceptance criteria

• Define which raw, staged, calculator-ready, and calculated outputs are local-only versus commit-safe.
• Add disclosure-risk checklist items for small cell counts, rare combinations, direct identifiers, dates, admission IDs, and joined clinical features.
• Add docs guidance that public examples use tiny synthetic fixtures for committed artifacts and local-only real-data outputs for user runs.
• Add guard tests or CI checks for accidental patient-level output files in committed paths.

Dependencies

• Public Clinical Dataset Worked Example.
• Public dataset downloader/cache guard and provenance/data-quality report contracts if implemented.