feat: add shareable prove reports

[peg]

Summary

• Add snare prove --output <path> to write text or JSON proof report artifacts.
• Add snare prove --redact to remove device IDs, token IDs, labels, cleanup tokens, and absolute local paths from shareable reports.
• Expand proof reports with event visibility, observed callback latency, and explicit proof/limitation sections.
• Document the share-safe proof artifact flow and update the changelog.

Tests

• gofmt -w internal/cli/cmd_confidence.go internal/cli/confidence_test.go
• git diff --check
• go test ./... -count=1
• npm ci in worker/
• npm test -- --run in worker/
• go run ./cmd/snare prove --help