v0.8.37 — India-PII masking hardening (DPDP bundle, UIDAI Aadhaar mask, fresh UPI handles)

The India-PII detectors (Aadhaar+Verhoeff / PAN / UPI / IFSC / Devanagari) shipped in v0.8.9; this sharpens the masking + ergonomics around them.

Added

• apply_india_dpdp_2023() returns IndiaDPDP2023Bundle(config, policy) (mirroring apply_camouflage_resistant): the DPDP tool/capability gate plus an AirlockConfig with India PII masking pre-enabled (mask_pii/mask_secrets/sanitize_output on, "in" in pii_locales). One call now delivers the DPDP-aware masking the policy only pointed at. Exported from the root.

Changed

• Aadhaar / PAN / UPI masking now matches its documented (safer) intent. Previously the maskers fell through to a generic first-3+last-3 render despite comments/README claiming otherwise:
  • Aadhaar → last-4 only (234567890124 → ********0124), the UIDAI masked-Aadhaar standard (prior render leaked 6 of 12 digits).
  • PAN → first-2 + last-2 (AB******4F).
  • UPI → mask local, keep @bank (alice@oksbi → a***@oksbi).
    README example (which showed fabricated outputs) + inline comments corrected. Opt-in pii_locales=["in"] surface only; strictly more private.
• Refreshed the UPI handle allowlist to current NPCI handles — WhatsApp Pay, major private banks, Paytm Payments Bank, Slice, CRED.

56 indic-PII tests; Pydantic-only zero-dep core + deny-by-default unchanged. (#105)