v1.6.0: provide share-safe adoption diagnostics

[jeffhuber]

Part of #1066.

Problem

The v1.5.2 hosted Devin rehearsal confirmed that several adoption-oriented JSON and dry-run surfaces can include absolute executable, configuration, workflow, or template paths. The documented cloud privacy boundary remains intact, but output intended to be pasted into an issue or adoption report should be share-safe by construction.

Scope

Define and implement a backward-compatible share-safe output mode for adoption diagnostics and generated adoption prompts. Prefer path-redacted output automatically for hosted/adoption reporting surfaces while retaining an explicit local-debug opt-in for paths scripts genuinely need.

Acceptance criteria

• Adoption and hosted posture JSON used by maintained prompts contains no home directory, checkout path, executable path, or packaged-template path by default.
• An explicit option such as --include-local-paths restores local diagnostic paths where supported.
• Existing machine consumers receive a documented compatibility path; do not silently remove fields without a schema/version decision.
• Maintained prompt-pack commands request the share-safe form.
• Tests use synthetic usernames and paths and assert that raw local paths cannot escape.
• No cloud schema or upload boundary is widened.

Code Mower delivery

Produce one focused PR with a named builder, one writer, privacy-focused fixtures, docs, and an independent exact-head Code Mower review. Resolve every P0/P1/P2 finding before merge and pass normal CI plus code-mower/gate.

[jeffhuber]

Implementation PR opened from the required #1064 baseline: #1102. Exact head aa989ad1 makes adoption/hosted doctor output path-redacted by default, adds explicit --share-safe and private-debug --include-local-paths, preserves report fields/check IDs, updates maintained prompt commands, and changes no cloud schema. Focused and adjacent doctor suites, a real hosted-adoption JSON rehearsal, docs lifecycle, Ruff, privacy, and diff checks pass. Independent exact-head audits and the full CI/gate matrix are requested before merge.

[jeffhuber]

Compatibility refinement pushed at exact head 0bbccddb: share-safe adoption/hosted JSON adds local_paths: redacted, while --include-local-paths now restores the exact legacy top-level key set as well as legacy path values for strict existing machine consumers. Focused tests, a real opt-in rehearsal, docs lifecycle, Ruff, privacy, and diff hygiene pass. The prior aa989ad1 head is superseded; audits must bind to 0bbccddb.