feat(a2a): outbound PII redaction pipeline before cross-agent message send #7355

Problem

autobot-backend/a2a/security.py signs Agent Cards with HMAC (AUTOBOT_A2A_SECRET) so receivers can verify a card was issued by this AutoBot instance and hasn't been tampered with — that proves identity and integrity, not data safety. There is no scrubbing on the message body sent to remote agents via a2a/task_executor.py or a2a/task_manager.py. Today an outbound A2A message can contain:

• API keys / tokens copied from agent context (chat history, env vars surfaced into prompts)
• Email addresses, phone numbers, names from RAG retrieval
• Internal IP addresses, hostnames from system_commands agent output
• Customer IDs, transaction details from data-analysis agent output

When AutoBot runs in a single-tenant local deployment this is acceptable. As soon as A2A is used between trust boundaries (a partner instance, a public agent registry), every outbound message is a data-leak vector.

Proposed change

New module autobot-backend/a2a/pii_pipeline.py that runs as a mandatory step on every outbound A2A payload:

1. 14-type detector — emails, phone numbers (E.164 + national), SSN/national-ID patterns, credit-card (Luhn-validated), API-key shapes (sk-..., Bearer ..., common cloud key patterns), JWT, AWS access-key IDs, IP addresses (private + public), MAC, internal hostnames, customer IDs (configurable regex), full names (NER, optional), street addresses (NER, optional), generic high-entropy strings
2. Per-trust-level policy — BLOCK (reject the send), REDACT (replace with [REDACTED:type]), HASH (SHA-256 prefix), PASS. Trust level resolved from peer identity in the existing security card flow
3. Hook point — single chokepoint in a2a/task_executor.py before any HTTP send. Failing the pipeline raises a typed exception that gets logged + returned as a structured error, never silently dropped
4. Audit trail — every redaction event recorded with (message_id, type, action, peer) so post-hoc audits can prove what was scrubbed
5. Configurable per-tenant — pipeline rules in autobot_shared/ssot_config.py so deployments can turn detectors on/off

Acceptance criteria

• pii_pipeline.py exists with 14 detectors, each with unit tests for true-positive + false-positive cases
• Single chokepoint in a2a/task_executor.py — grep for outbound HTTP send proves no path bypasses the pipeline
• Trust-level policy table loaded from config; BLOCK raises typed PIIBlocked exception
• Audit log entries written to existing structured-log channel with redaction count + types
• Integration test: outbound message containing AWS access key + email + internal IP → all three redacted, audit log records 3 events
• Performance: pipeline adds <5ms p99 on a 1KB message (benchmarked)
• At least one production caller invokes the pipeline (process: systemic premature-closure pattern — 7+ feature trackers closed before integration (orchestration audit evidence) #6836 wire-in gate)

Why this is P1

• A2A is already shipped; the gap is silent — there's no warning today that outbound messages aren't scrubbed
• HMAC scaffolding (security.py) is the right structural place to add the pipeline, so this is incremental, not foundational

Out of scope

• Inbound prompt-injection defence (separate issue, complementary)
• Per-message encryption (TLS already covers this at transport)