test: freeze Privacy Filter G0 evaluation contract

[rmorse]

Summary

• freeze the Phase 0 typed privacy policy, smoke corpus, and statistically locked broad-quality corpus
• enforce deterministic metrics, sliced leak reporting, authoritative G0 gate failures, workload budgets, artifact identity, and one-target broad denominators
• add realistic provider-neutral synthetic secrets plus repeated, overlapping, split, and developer-owned secret regressions
• add the digest-pinned, offline Docker DistilBERT baseline workflow without changing the production detector
• retain f0c08c0 (docs: make Docker CI authoritative for PII evals) in history

Verification

• go test ./...
• go vet ./...
• go test -race ./...
• git diff --check
• GitHub unit/vet, Docker/Linux race, Windows race, and G0 hermetic jobs pass for both push and pull-request events
• Docker CI evaluated 3,010 synthetic cases and uploaded schema-v2 aggregate DistilBERT reports for both events

The local host has no Docker engine, so Docker evidence comes from GitHub Actions.

Gate status

Phase 0/G0 machinery is implemented and the Docker baseline now executes end to end, but G0 remains not-run. The emitted report records hardware_contract_ready=false and reason stable-hardware-identities-not-frozen. The checked H0/H1/H2 hardware identity contract is intentionally unprovisioned; concrete runner names, hardware fields, and reviewed fingerprints must be supplied by the infrastructure owner before the authoritative job can pass and its baseline can be anchored.

Privacy Filter adapter/model integration has not started.