feat: add auditable publication hygiene gates

[szmyty]

Summary

• add named hygiene policies to Renderflow v2 specs and derivative profiles
• create a non-destructive pre-publication stage with explicit artifact lineage
• sanitize allowlisted/denylisted artifact metadata plus supported JPEG EXIF/XMP/IPTC/comments and PNG EXIF/text chunks
• block likely secrets with evidence-safe diagnostics that never reproduce detected values
• add configurable protected-reference scanning for brand, franchise, company, creator, and work names in generated text and metadata
• add provider-neutral deterministic/probabilistic content-redaction contracts
• require explicit rights/license/approval evidence for public and commercial bundles
• preserve blocked/review-required candidates in the artifact store without materializing them into release bundles
• publish renderflow.hygiene/v1 evidence and advertise the capability through the provider contract
• document policy boundaries, including that protected-reference findings are review signals rather than legal copyright conclusions

Validation

• cargo check --workspace --all-targets
• cargo test --package renderflow hygiene::tests --no-fail-fast — 3 passed
• publication-hygiene example validates through the CLI
• runtime-generated v2 schema matches the committed schema
• focused safe/blocked CLI smoke builds verified release and candidate-preservation behavior
• JSON schema files parse successfully

Full-suite/Clippy/CI hardening remains deferred under the current sprint convention.

Follow-up

Artifact DNA extraction and similarity guidance is captured in #387 and explicitly depends on this hygiene boundary.

Closes #361

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 10⭐
  Check Your Progress