Publish capability: core.redact-for-export (policy-shaped PII/secret redact-before-export)

## Why

Agents and exporters often dump structured records (support tickets, KYC packets, audit logs) into outbound channels. The registry already has model-backed NER redaction (`text.redact-entities`) but **no policy-shaped, deterministic redact-before-export** gate that treats secrets + declared PII fields under an explicit export policy. Apps are not ready — we need the capability first so runtimes can fail closed before data leaves.

Distinguish from `text.redact-entities`: this is **not** NER. It is rule/policy evaluation over structured payloads + optional secret pattern detectors.

## One-PR ask

Publish **`core.redact-for-export@1.0.0`** (namespace `core` per current registry convention):

**Inputs (contract):**
- `payload`: object (JSON) to export
- `policy`: versioned object with at least:
- `version`: string
- `field_rules`: array of `{ "path": string, "action": "redact"|"drop"|"keep", "replacement"?: string }` (JSON-pointer or dotted path — pick one, document, test)
- `secret_patterns?`: array of `{ "id": string, "regex": string }` (RE2-safe subset; document engine)
- `fail_mode`: `"fail_closed"` | `"redact_all_matched"` (default fail_closed on invalid policy)
- `purpose?`: string (echoed in output only; no network)

**Outputs:**
- `redacted_payload`: object
- `actions_applied`: array of `{ "path_or_match", "action", "rule_id"? }`
- `policy_version`: string
- `ok`: boolean
- `reason_code`: enum e.g. `ok` | `invalid_policy` | `path_not_found_fail_closed` | `secret_matched`

**Behavior:** Pure, deterministic, side-effect-free. Invalid policy → fail closed (`ok: false`), do not partially export.

Follow [`CONTRIBUTING.md`](https://github.com/traverse-framework/registry/blob/main/CONTRIBUTING.md) and [`capabilities/README.md`](https://github.com/traverse-framework/registry/blob/main/capabilities/README.md) publish checklist.

- Include `capability-src/` with real Rust tests meeting registry coverage gates (`functions` 100%, lines/regions ≥ 95%)
- Use `traverse-cli capability publish` (or the documented scaffold) so `artifact.digest` / `artifact.url` survive
- Declare `authoring.method` (`human` or `llm-assisted`)
- Ensure every `use_cases[].persona_ref` resolves (scaffold personas if needed)
- Run `bash scripts/ci/pre_pr_check.sh ` before opening
- One capability per PR; branch from `origin/main`, not another `publish/*` branch

**Apps are not ready — publish the capability only.** No app wiring, no demo product surface.

## Out of scope

- Calling external DLP/NER models or reimplementing `text.redact-entities`
- Streaming / multipart file redaction
- Persisting redaction audit logs (caller owns storage)
- Changing registry CI gates

## Done when

- CI green on the publish PR
- Capability appears in the next index release after merge
- Contract `use_cases` follow persona/user-story format if required by FR-011
- Tests cover: field redact, field drop, secret regex hit, invalid policy fail-closed

## Host / deps notes

**Pure WASM.** `network_access: forbidden`, no host state, no connector. Pattern matching must compile cleanly to the registry's wasm target — document the crate choice.

## Labels

`help wanted` · `good first issue` · `enhancement` · `no-spec-needed`

Read CONTRIBUTING.md and capabilities/README.md, then inspect the documented traverse-cli capability publish scaffold and existing capability-src/ examples. Implement the capability with real Rust tests for field redact, field drop, secret regex hits, and invalid-policy fail-closed behavior, while documenting the path and regex choices. Run the coverage checks and bash scripts/ci/pre_pr_check.sh ; done means the publish checklist and CI pass.

Written by the indexing model from the issue text.