feat(sec-core): migrate PII checker to Rust

[1570005763]

Why

PII scanning still depended on the V1 Python runtime. This migrates phase 1 to the Rust V2 daemon while preserving the supported scan and Hook contracts and preparing typed evidence for later policy integration.

What changed

• Port 11 built-in detectors, validators, confidence, Unicode spans and redaction with 142 frozen V1 cases and a separate labeled corpus for intentional scanner 2.0.0 changes.
• Compile one administrator-managed custom ruleset at startup and report execution status, coverage, input digests and rule identity.
• Route action.pii_scan and compatible scan-pii CLI through shared ActionRuntime, sanitized projection and Finalizer, including authorized parameter failures.
• Bound response details after complete detection and redaction, retaining the full verdict and counts so dense findings do not become a transport error or bypass Hook blocking.
• Add real UDS/CLI, shared V1/V2 PII, six Hook and installed RPM acceptance, plus bilingual migration/usage documentation.

Five logical commits: core, rules, runtime/audit, RPC/CLI, acceptance/docs. The shared infrastructure from #3246 is already on the main base and is not included in this PR.

Related issue

no-issue: implements the approved two-stage PII migration design and five-commit phase-1 delivery plan.

User / Agent impact

V2 supports scan-pii without Python detection or a local fallback. Custom rules use /etc/agent-sec/pii-checker/rules.yaml (or daemon --pii-rules) and restart to update. Completed pass/warn/deny results exit 0; coverage exposes incomplete detection. Existing host behavior is preserved through direct Hook contract tests; this PR does not switch running Agent hosts or perform PDP enforcement.

Risk and compatibility

• Public CLI, API, configuration, or documented behavior changed
• Privileged or security-sensitive behavior changed
• Cross-component contract changed
• Migration or rollback guidance is needed

The daemon authorizes LocalUser from UDS peer identity and never accepts input/rule paths from scan RPC. Audit uses a field allowlist and excludes original text, raw evidence, full redacted output and rule/exception content. Invalid custom rules leave built-ins running with partial coverage. Custom rules follow native fancy-regex semantics, documented with positive/negative span controls. invalid_regex reports actual syntax, compilation or engine-limit failures; semantic differences from Python alone are not errors. Match-budget differences are documented; no default truncation is added, and the existing 4 MiB frame bound remains explicit. Opaque V1 trace metadata is not treated as OpenTelemetry IDs.

Detection behavior is versioned as summary.scanner_version: "2.0.0", independently of package versions and CI commit IDs, and participates in ruleset identity. Compact JWT claims objects are now detected; Unicode decimal ID dates/check digits are normalized before validation; all-zero card placeholders are rejected. Rust's structural JWT parser intentionally accepts valid large-number/deeply nested objects without recreating Python integer/recursion limits. Signature authenticity is outside detector scope. Preserved V1 fixtures exclude only nondeterministic/additive fields and explicitly versioned engine provenance; new behavior has dedicated positive and negative tests. These tests do not establish a production-wide false-positive or false-negative rate.

Large reports use a 512 KiB formatted-JSON budget. The executor keeps one real finding per type/severity, removes raw evidence, and marks reduced details with summary.findings_truncated. Complete verdict/counts/digests/scan coverage remain intact. If full redacted output still cannot fit, it is replaced entirely with [REDACTED: output size limit] and summary.redacted_text_omitted=true. Six Hook adapters use full summary counts in notices. Normal reports and existing failure policies retain their behavior; no pagination, cache, or new policy infrastructure is introduced.

Validation

Local environment: macOS, Python 3.11.6 and Node.js.

• Targeted Python PII Hook tests for Codex, Cosh, Hermes, Qwen Code and Qoder:
  252 passed.
• OpenClaw tests/unit/pii-scan-test.ts: 26 passed.
• make python-code-pretty and cargo fmt --all -- --check: passed.
• Changed-file Ruff comparison: no new diagnostics; 10 existing Hermes diagnostics remain.
• bash scripts/docs-lint.sh, python3 scripts/docs-link-check.py, and
  git diff --check: passed.
• PII CLI and Hook E2E collection: 238 collected. This was collection-only,
  not local execution of those E2E cases.

Linux-only Rust build, Clippy, workspace tests, rustdoc, UDS runtime and installed-RPM
acceptance were not run on this local macOS machine.

Documentation and rollback

Updated English/Chinese PII guides, READMEs, two-stage design, relevant versioned behavior contracts and the bundled Skill. Restore the previous central YAML and restart for a rules rollback. For runtime rollback, stop the V2 validation daemon and restore V1 packages/entrypoints and retained user rules. V1 detection implementation is preserved. Full PIP/PDP/PEP and real host cutover remain separate work.