provider: local-first escalation policy + privacy/audit for gated providers

[matedev01]

Goal: keep it local-first — escalate to a gated provider only under explicit policy, with an audit trail.

Sub-steps

• Escalation policy: local-first; escalate only under the gate (extend rc.1's cloud-escalation).
• Privacy: define + audit what data leaves the device; redact where needed.

M2 · Workstream C.