feat: add local handoff privacy preflight

[Yuki9814]

Summary

• add an opt-in, entirely local privacy preflight for final handoff Markdown
• keep the toggle ephemeral and schema-neutral; default-off exports remain byte-compatible
• use one redacted Markdown value for preview, clipboard, and download
• fail closed on input, finding, credential-value, and ambiguous-quote limits
• cover private keys, GitHub/AWS/bearer/JWT credentials, common credential URLs, and explicit credential assignments without returning raw matches
• prepare the minor release as v0.5.0

Verification

• lint: pass
• unit/component: 128 tests pass
• Chromium E2E: 13 tests pass
• production build: 294.66 kB JS / 88.84 kB gzip
• Pages asset-path audit: pass
• dependency audit: 0 vulnerabilities across 270 dependencies (live baseline and final offline lock audit)
• near-2M adversarial inputs: private-key 13.7ms; assignment 319ms; multi-word names 122ms; JWT 327ms; URL without @ 11ms; newline-heavy key 29ms
• independent exact-final review: no P0/P1/P2

Evidence boundary

Part of #13. This is internal implementation and regression evidence only. External maintainer trials: N=0. No external usability or adoption claim is made, and the external-evidence issue remains open.