feat(security): enforce shared capture policy

[kev1n77]

Summary

• add a versioned Capture Policy contract and schema for exact hosts, POST methods, approved endpoint paths, and normalized sensitive field names
• enforce the same policy in the Python mitmproxy sidecar and a new trusted Rust Core ingestion boundary
• reject out-of-scope envelopes and re-scrub headers, query fields, and nested JSON before persistence
• embed the policy in PyInstaller artifacts and fix Windows onefile probe process-tree cleanup
• update security evidence and progress without marking SEC-001 complete before DB/log/temp canary validation

Verification

• cargo fmt --all -- --check
• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• python -m unittest discover -s sidecars/mitmproxy/tests -v (10 tests)
• npm run desktop:check (3 tests)
• packaged Windows sidecar integration probe: forwarding preserved, prompt preserved, credential canaries in envelope = 0
• packaged sidecar process count after probe = 0
• HTML links/fragments and git diff --check

Security boundary

Only SanitizedCapture values returned by codeischeap-core are eligible for persistence. Real persistence remains blocked on DAT-001 and the remaining SEC-001 DB/log/temp canary checks.