Data egress controls

A dependency-free Node gate classifies a context bundle against eleven regexes before it ships

The policy lives in a JSON file a reviewer can read without reading the code, and the gate resolves overlapping matches by severity, so a JWT found inside a log line is denied instead of merely warned on.