feat(identity): honour include_sensitive as a real second escalation

[stormer78]

Backlog follow-up (tasks/follow-ups.md → "Honour include_sensitive as a real second escalation").

The problem

The pool listing behind the identity pane's show_values (v) passed the one include_values flag to both SDK arguments, so turning values on pulled every sensitivity: high value — card numbers, ids — into the process. Passing include_sensitive: false naively was not the fix either: a high-sensitivity attribute would then come back valueless and render as (no value), indistinguishable from "you hold nothing here" (the masked_is_not_the_same_state_as_absent invariant). The module header already documented this exact intended fix.

The change (split the two escalations)

• pool::list takes include_sensitive separately; the bulk read passes false, so sensitive values never enter memory in bulk.
• pool::reveal fetches one attribute's value on its own — a type_prefix-scoped list with include_sensitive: true, filtered by id (the SDK has no by-id read). Behind the per-attribute s key.
• PoolAttribute::is_withheld_sensitive + ClaimTypeDefaults::is_sensitive tell "withheld because sensitive, not fetched" apart from "genuinely absent".
• s (RevealValue) becomes a targeted fetch only for a withheld sensitive value (new PersonaJob::AttributeReveal → PersonaOutcome::AttributeRevealed splices the value into the in-memory row and lifts the mask). A value already in memory is still an instant mask-lift; a genuinely-absent row still just toggles — so existing reveal behaviour/tests are unchanged.
• The pane renders a third state — sensitive — not loaded with s to show — so a withheld card number never reads as (no value).

Net effect: pressing v no longer loads every card number into memory; each sensitive value is fetched only when the holder asks for that one with s, and the reveal stays truthful.

No dependency bump

persona_attribute_list in the pinned vta-sdk 0.42.1 already carries type_prefix and include_sensitive.

Tests / gates

• pool::a_withheld_sensitive_value_is_distinct_from_absent (the third-state invariant, asserting its own fixture classification).
• a_reveal_of_a_withheld_sensitive_value_fetches_it (reducer: s on a sensitive valueless row returns a fetch job and reveals nothing until it returns); existing reveal tests still pass unchanged.
• cargo fmt, clippy --all-targets --all-features, RUSTDOCFLAGS="-D warnings" cargo doc, full cargo test all pass.