feat(prove): externally demonstrable no-plaintext-to-relay + data-flow X-ray (E-07/E-08)

[ChelseaKR]

Make the "ciphertext-only to relay" invariant something skeptics can see, not
just a test they must trust, and give users a local account of what each
component would expose.

E-07 — habitable prove-no-plaintext (src/habitable/prove.py):

• Fabricates a synthetic case (reusing demo._make_photos) seeded with distinctive
  plaintext markers: note text, issue title, source filename, vault passphrase,
  passphrase-derived node_id, device fingerprint, and raw image bytes.
• Starts the real relay in-process on 127.0.0.1 and wire-taps the transport so
  every byte sent/received is written verbatim to a capture file (xxd/grep-able).
• Runs a real sync round-trip, then greps the captured bytes (raw, base64-encoded,
  and base64-decoded) for every marker; reports bytes captured, markers searched,
  hit count, and the capture path. Exits nonzero on any hit.
• Prints a tcpdump/tshark procedure for repeating the check against a remote relay.
• docs/prove-no-plaintext.md documents both the built-in check and the manual
  packet-capture procedure (incl. TLS vs app-layer caveats); linked from README
  and docs/privacy.md.

E-08 — habitable status --xray (data_flow_xray in prove.py):

• A fully local, telemetry-free per-component table of what leaves the device
  (capture -> nothing, TSA -> a hash, relay -> sealed blobs + a mailbox id,
  export -> a plaintext packet the user initiates), derived from the user's own
  vault (item counts, configured authorities). No network calls.

tests/test_prove.py: clean end-to-end prove run (exit 0, capture greps clean), a
monkeypatched deliberate plaintext leak forcing exit nonzero, and --xray/render
coverage asserting all components are listed with no network access.

Marks E-07/E-08 done in docs/research/synthetic-personas-feedback.md.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

---

Backfill PR for a completed roadmap item (roadmap/externally-demonstrable-no-plaintext-to--9, 1 commit(s) over main). Part of the portfolio roadmap batch.