Improve log redaction provenance gates

[DENGXUELIN]

Summary

• add log redaction and sensitive-field provenance evidence gates
• require sensitive field inventory, parser/enrichment provenance, redaction stage, raw-to-redacted linkage, role-gated raw access, sample verification, and downstream export checks
• add vulnerable and benign fixtures covering post-index token leakage versus pre-index redaction with hash linkage

Validation

• git diff --check origin/main...HEAD
• Markdown fence balance check
• Added-line ASCII check
• Content marker check for sensitive field, provenance, redaction stage, raw access, downstream exports, sample verification, and pre-index evidence
• git merge-tree --write-tree origin/main HEAD

Closes #1579

Bounty request: Improver Moderate / USD 100 if accepted.