Add managed day-zero privacy screening

[HLLMR]

Summary

• create a durable project-specific privacy profile automatically during writwall start
• let projection build and check commands resolve that managed profile without a human-supplied path
• preserve the explicit compatibility override while keeping profile paths, values, matches, and hashes out of normal output and repository records
• add link, concurrency, credential-shape, missing-state, cleanup-survival, and cross-platform coverage

Verification

• Windows full suite: 715 passed, 2 skipped
• focused coordinator/projection/privacy suite: 109 passed
• native Ubuntu privacy suite: 8 passed; profile mode 0600
• two independent 131-file projections passed and were byte-identical
• fresh independent re-review: ACCEPT

Closes #10