Implement default-discard privacy ingest with synchronous LLM scan fallback

A privacy pipeline spec changed the retention posture from retaining encrypted raw text to default-discard. Existing schema and write paths still had raw-retention fields, async-only LLM review semantics, and stale docs/runbook references. The implementation needed to drop raw-retention schema declarations, keep raw text out of fallback jobs, and preserve audit provenance for clean and flagged ingest scans.