feat(core): add evidence sanitizers

[ElbertePlinio]

Changed

• Strengthen redaction for Cookie/Set-Cookie, Authorization, bare JWTs, query/session tokens, OTP/CSRF values, and CDP capability URLs.
• Add fail-closed structured sanitizers for URLs, errors, typed values, action targets, and network failures.
• Persist no raw typed values, headers, bodies, query strings, userinfo, or unknown target fields through these APIs.
• Preserve useful Set-Cookie attributes and surrounding XML/JSON structure where safely distinguishable; malformed credential syntax fails closed.

This completes PR 1 of #20. Storage and instrumentation remain separate slices.

Validated

• Focused sanitizer/redaction tests: 53/53
• Full suite: 71 files, 820 passed / 2 skipped
• Typecheck and coverage thresholds passed
• Serious privacy/correctness workflow review; all P1-P3 findings fixed
• Final malformed trailing-junk cookie regression accepted with deterministic full-suite proof at the three-HEAD review ceiling

Risk

This slice strengthens already-shipping free-text redaction and adds dormant structured APIs. Fail-closed redaction may remove more malformed credential text than before. Unrelated Xvfb suite flakiness is tracked in #32.

Refs #20
Refs #17
Refs #32