v0.4.0-phase3 — privacy defaults

Phase 3: privacy defaults.

• Do Not Track + Global Privacy Control on by default. New patch patches/privacy/enable-do-not-track-by-default.patch flips the kEnableDoNotTrack profile-pref default to true; Chromium reads it into the renderer preference that emits both DNT: 1 and Sec-GPC: 1. Validated against the pin (isolated + full 109-patch series).
• Third-party cookie blocking was found already covered by the adopted inox default-prefs patch (kCookieControlsMode → kBlockThirdParty); a DuckDuckGo default-search patch is deferred (needs a build to verify) rather than shipped as a guess. See patches/privacy/README.md.