feat: export privacy-safe support bundles

[kev1n77]

Summary

• generate a versioned support bundle from an explicit allowlist of diagnostic fields without serializing captured requests
• declare and verify that Prompt content, request identifiers, Raw capture, and logs are excluded
• scan runtime issue text with the credential scrubber and expose exact redaction locations in the preview
• rebuild and hash-check support bundles before creating a new JSON file
• let Diagnostics preview, copy, and save the exact support document through native commands or the synthetic web fallback
• update SEC-002, REL-002, security, and threat-model evidence without marking remaining log/corpus work complete

Verification

• cargo fmt --all -- --check
• cargo fmt --manifest-path apps/desktop/src-tauri/Cargo.toml -- --check
• cargo test --workspace --all-targets
• cargo clippy --workspace --all-targets -- -D warnings
• cargo test --manifest-path apps/desktop/src-tauri/Cargo.toml --all-targets
• cargo clippy --manifest-path apps/desktop/src-tauri/Cargo.toml --all-targets -- -D warnings
• npm run desktop:check (34 tests)
• npm run desktop:build
• local browser QA: Diagnostics support preview and actions render without overlap or console warnings/errors