feat: enforce privacy-safe event boundary

[tuzuminami]

Summary

• apply the v4 safe event profile to memory, SQLite, API, previews, and exports
• replace raw event/case/source IDs with project-scoped HMAC references and a verified local 0600 key
• sanitize legacy URL domains to hostname-only and fail closed until SQLite privacy cleanup completes
• add regression coverage for raw sentinels, key loss/replacement, cross-project IDs, cleanup retry, and API response echoes

Closes #76

Verification

• ./scripts/lint.sh
• ./scripts/check_licenses.sh
• ./scripts/check_no_external_network.sh
• ./scripts/test.sh
• ./scripts/perf_smoke.sh
• ./scripts/perf_http_smoke.sh

Performance recovery

• replace deep dataclasses.asdict() copies during local scope fingerprint creation with a shallow projection of declared StandardEvent fields
• preserve the exact legacy fingerprint value; ignore dynamic/transient attributes
• remove remaining deep copies from v4 persistence payload serialization and import-deduplication fingerprints
• run the redundant second minimization only when an ID collision produced a non-v1 derived ID; unique v1-opaque imports keep the privacy boundary result unchanged
• duplicate/reserved-ID fallbacks retain deterministic collision handling and HMAC normalization before SQLite persistence
• local 100k-event summary: 3.623s → 2.427s (three follow-up runs: 2.449s, 2.368s, 2.356s); final full-gate run: 2.643s
• local 100k-event HTTP smoke: CSV import 4.836s, JSON import 5.176s (both below the 15s limit)
• full required local gates pass; macOS CI has been re-triggered for head 54110e5