Add Opt-In Payload Privacy Policy Engine for Context and Final Output

[dgenio]

Description

Redaction covers logs, not payload governance at merge and output boundaries.

Use case

Security-sensitive teams need policy-enforced data handling inside flow execution.

Proposed solution

• Add opt-in privacy policy hooks before context merge.
• Add output policy pass before final_output is returned.
• Support actions: mask, drop, block, and reason tags.
• Provide dry-run mode that reports policy hits without mutation.
• Add tests for merge collisions with policy decisions.

Alternatives considered

• Keep privacy policy only in host applications.
• Rely on logging redaction alone.
• Add documentation without runtime hooks.