Implement Slice Six provider-backed pseudonymization

[sidmohan0]

Summary

• canonize the keyed pseudonymization contract and exclude unkeyed hashing from the privacy core
• add HMAC-SHA-256 pseudonymization with asynchronous provider-backed key resolution
• expose the PrivacyManager through Rust, Python, and Node while failing closed in browser WASM
• remove original matched PII from transformation records and retain source provenance
• add Core and installed-package coverage for deterministic tokens, key validation, selector deduplication, providerless calls, and WASM rejection

Verification

• cargo fmt --all --check
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• cargo test --workspace --all-features
• maturin build --manifest-path bindings/python/Cargo.toml --release and installed-wheel contract test
• npm run test:package --prefix bindings/node
• npm run test:package --prefix bindings/wasm