feat(proxy/store): add a privacy-safe export digest

A handoff digest of the local findings, built from an allowlist rather than by
redacting a full plan: identities, magnitudes and rungs only. No locators, no
evidence maps, no paths, and identity-bearing sink ids are collapsed to their
family before they leave the machine.

Allowlist-in, not denylist-out, so a field added to the plan later cannot leak
by default.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>