Add PII redaction POC for secure LLM prompting.

Implements detect-redact-sanitize pipeline with regex, domain rules, and ONNX NER before the LLM boundary, plus NUnit tests and Xenovex push documentation.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/PiiRedaction.Core.Tests/Detection/OnnxNerPiiDetectorTests.cs

@@ -0,0 +1,54 @@
+using FluentAssertions;
+using PiiRedaction.Core.Detection;
+using PiiRedaction.Core.Models;
+using PiiRedaction.Core.Tests.TestSupport;
+
+namespace PiiRedaction.Core.Tests.Detection;
+
+[TestFixture]
+public sealed class OnnxNerPiiDetectorTests
+{
+    [Test]
+    public void Detect_ModelAvailable_ReturnsRunnerEntities()
+    {
+        var runner = new FakeOnnxNerModelRunner
+        {
+            IsModelAvailable = true,
+            EntitiesToReturn =
+            [
+                new PiiEntity(PiiEntityType.Person, "Onnx Person", 0, 11, PiiDetectionSource.Ner)
+            ]
+        };
+
+        var detector = new OnnxNerPiiDetector(runner);
+        var entities = detector.Detect("Any text");
+
+        entities.Should().ContainSingle(entity => entity.Value == "Onnx Person");
+        runner.LastPredictedText.Should().Be("Any text");
+    }
+
+    [Test]
+    public void Detect_ModelUnavailable_ReturnsEmpty()
+    {
+        var detector = CreateDetector(modelAvailable: false);
+        var entities = detector.Detect("Customer Ravi Kumar with email test@x.com.");
+
+        entities.Should().BeEmpty();
+    }
+
+    [TestCase(null)]
+    [TestCase("")]
+    [TestCase("   ")]
+    public void Detect_InvalidInput_ThrowsArgumentException(string? text)
+    {
+        var detector = CreateDetector(modelAvailable: false);
+        var action = () => detector.Detect(text!);
+        action.Should().Throw<ArgumentException>();
+    }
+
+    private static OnnxNerPiiDetector CreateDetector(bool modelAvailable)
+    {
+        var runner = new FakeOnnxNerModelRunner { IsModelAvailable = modelAvailable };
+        return new OnnxNerPiiDetector(runner);
+    }
+}