Add PII redaction POC for secure LLM prompting.

Implements detect-redact-sanitize pipeline with regex, domain rules, and ONNX NER before the LLM boundary, plus NUnit tests and Xenovex push documentation.

Co-authored-by: Cursor <cursoragent@cursor.com>

tests/PiiRedaction.Core.Tests/Integration/GoldenPromptTests.cs

@@ -0,0 +1,25 @@
+using FluentAssertions;
+using PiiRedaction.Core.Models;
+using PiiRedaction.Core.Tests.TestSupport;
+
+namespace PiiRedaction.Core.Tests.Integration;
+
+[TestFixture]
+public sealed class GoldenPromptTests
+{
+    [TestCaseSource(typeof(PromptScenarioCatalog), nameof(PromptScenarioCatalog.AllScenarios))]
+    public void Sanitize_PromptScenario_ProducesExpectedOutput(PromptScenario scenario)
+    {
+        var sanitizer = ProductionPipelineFactory.CreateForScenario(scenario);
+        var result = sanitizer.Sanitize(new SanitizationRequest(scenario.Prompt));
+
+        result.SanitizedPrompt.Should().Be(scenario.ExpectedSanitized, because: scenario.Name);
+        result.DetectedEntities.Select(entity => entity.Type)
+            .Should().BeEquivalentTo(scenario.ExpectedTypes, because: scenario.Name);
+
+        foreach (var forbidden in scenario.MustNotContainInSanitized)
+        {
+            result.SanitizedPrompt.Should().NotContain(forbidden, because: scenario.Name);
+        }
+    }
+}