FIX-10: Strip wall-clock/node metadata from exported identifiers

[ChelseaKR]

Exported ids (issue_id, capture_id, timeline entry_id, custody item_id) and the
exported hlc fields used to embed the raw hybrid logical clock —
wall_ms.counter.node_id — leaking the device wall clock and a stable node id
into shared packets. Derive externally visible identifiers from an opaque,
per-case-salted mapping instead; keep the HLC internal for CRDT ordering/merge.

• model.py: mint a 16-byte per-case salt at case init (stored hex in the merged
  document meta, so it syncs to peers like unit); add opaque_id(prefix, hlc)
  = {prefix}-{HMAC(salt, hlc)[:16]}, deterministic per (salt, hlc) and stable
  across devices but revealing no wall time / node id. Issue, timeline, and
  capture ids now use it; the salt is generated lazily on first mint for
  documents that predate it. capture.py mints the capture id the same way.
• packet.py: pseudonymize the remaining raw HLC leakage in the export — the
  timeline entries' and custody entries' hlc — via the same per-case salt.
  Bump PACKET_VERSION to 2.
• evidence.py: integrity_proof(hlc_map=...) re-derives the exported custody
  chain over the mapped HLC values so it still verifies standalone; the vault's
  own chain is untouched (internal custody hashing unchanged).
• verify.py: raise SUPPORTED_PACKET_VERSION to 2; v1 still verifies.
• Golden corpus: add tests/golden/packet-v2 (regenerable via the new
  scripts/make_golden_packet.py); keep packet-v1 for back-compat verification.
• Tests: test_guards asserts no exported field encodes the wall-clock ms, the
  node id, or the raw HLC shape; test_model pins id determinism and opacity.
  CRDT merge/order property tests pass unchanged.
• Docs: note the opaque identifiers in the bundle schema; mark FIX-10 shipped.

Co-Authored-By: Claude Fable 5 noreply@anthropic.com

---

Backfill PR for a completed roadmap item (roadmap/fix-10-strip-wall-clock-node-metadata-fr, 1 commit(s) over main). Part of the portfolio roadmap batch.