Lets a consumer fully express its domain PII scrub as config instead of a
forked redactor: a per-pattern `validate` predicate (e.g. Luhn over a
card-number candidate, so a Luhn-invalid 16-digit string is left alone) and
`extraSensitiveKeys` for key names the defaults miss (e.g. snake_case
`api_key`). Both additive; no-options behavior is byte-identical.