fix: block private context at claim intake

[wolverin0]

Summary

• add claim-only redaction for bare RFC1918 addresses and absolute Windows/UNC paths
• apply the policy to claim text, structured fields, and citation excerpts at the shared claim-ingest boundary
• preserve the existing raw source/evidence policy and allow repo-relative paths

Verification

• python -m pytest tests/test_claim_intake_private_context.py tests/test_security_access.py tests/test_security_patterns.py tests/test_store_persisted_envelope.py tests/test_sensitivity_filter_t07.py -q --tb=short (122 passed)
• python -m pytest tests/test_architecture_budgets.py -q --tb=short (5 passed)
• ruff check memorymaster/core/security.py tests/test_claim_intake_private_context.py
• no existing database rows mutated

Task: T-0127