feat: add privacy policy consistency checker

[gbasin]

Summary

• add docs/privacy-policy.md with machine-stable claim IDs (PP-001..PP-005)
• add static checker core at src/server/privacyPolicyChecker.ts and CLI bun run privacy:check
• integrate privacy check into scripts/test-runner.ts so it runs in standard bun run test
• add rule-focused tests in src/server/__tests__/privacyPolicyChecker.test.ts
• document usage in README.md

Enforced Claims

• PP-001: denylisted telemetry/analytics dependencies are rejected in package.json
• PP-002: runtime fetch() targets in src/client and src/server must be local-relative
• PP-003: /api/paste-image must assign /tmp path, perform a write operation, and return { path: filepath }
• PP-004: persisted Zustand stores across all runtime src/client files must use createJSONStorage(() => safeStorage); safeStorage must include in-memory fallback for unavailable/throwing localStorage
• PP-005: default DB/log paths must resolve under ~/.agentboard

Limitations

• static analysis only; this does not prove full runtime or legal/privacy compliance

Validation

• bun run lint && bun run typecheck && bun run test