tech-debt: consolidate duplicated privacy-score analyzers (Mode 2 + demo)

Source

Code-quality review of Cluster F1 (#216 demo mode, PR-to-be-created from feat/demo-mode at e3f2029..4286666).

Problem

`packages/agent/src/services/demo-wallet.ts:152-356` (added in F1) duplicates 4 analyzer functions + `KNOWN_PROGRAMS` const + `computeGrade` helper verbatim from `src/routes/privacy.ts:23-269` (Mode 2 REST API).

Any future change to the analyzers (e.g., adding a 5th factor, tuning round-amount denominators, expanding KNOWN_PROGRAMS) must be applied to BOTH files. Otherwise the demo copy silently drifts.

Why we duplicated for #216

Spec D17 explicitly accepted Strategy B (re-implement queries locally) given Mode 2's privacy/score route lives in a separately-built `dist/app.js` and cross-package import is messier than focused duplication. See `packages/agent/src/services/demo-wallet.ts` header comment lines 1-27 for the full rationale.

Proposed consolidation

Extract `KNOWN_PROGRAMS`, `computeGrade`, and the 4 `analyze*` functions to a shared module (e.g., `packages/sdk/src/privacy-analyzer.ts` or `packages/agent/src/services/privacy-analyzer.ts`) and have BOTH `src/routes/privacy.ts` and `packages/agent/src/services/demo-wallet.ts` import them.

When

Trigger this issue when:

• Anyone next touches `src/routes/privacy.ts` analyzers, OR
• Anyone next touches `packages/agent/src/services/demo-wallet.ts` analyzers, OR
• Phase 5 post-launch cleanup sweep

Until then, the duplication is documented (`demo-wallet.ts` lines 1-27) and tracked here.

Labels

tech-debt, priority:low

Source review

(filed by F1 fix-loop subagent during Wave 2b code-quality review on 2026-05-11)

Start with packages/agent/src/services/demo-wallet.ts:152-356 and src/routes/privacy.ts:23-269, comparing the duplicated KNOWN_PROGRAMS, computeGrade, and four analyze* functions. Read the demo-wallet.ts header rationale before choosing a shared module location. Done means both files import one shared analyzer implementation without behavior drift.