Phase K: protect private visual evidence

[datzle123]

Summary

• suppress standalone and trace-embedded screenshots before capture for known-sensitive or authenticated browser contexts
• suppress browser video before recording for sensitive fields, secretEnv, and auth-state contexts
• keep safe unauthenticated visual controls and publish only additive value-free suppression metadata
• refresh fingerprint-bound TodoMVC, Actual Budget, Conduit, Pocket Ledger, Level 7 role, PostgreSQL cleanup, and Codex MCP evidence

Local qualification

• pnpm check — 142 passed, 2 service-dependent skips
• pnpm audit --audit-level high — passed
• pnpm smoke — passed
• pnpm pack — passed
• installed-tarball smoke — passed

Phase K remains a release candidate until this PR and the merged main commit pass the signed hosted 15/15 gate.