data_diff: PII redaction / opt-in for sample diff rows

[anandgupta42]

Flagged during v0.5.22 release review (Security / Chaos Gremlin persona).

Up to 5 sample differing rows — including their raw values — appear in data_diff tool output (packages/opencode/src/altimate/tools/data-diff.ts ~L220) and up to 100 in aggregated partitioned diffs (native/connections/data-diff.ts mergeOutcomes). For tables containing PII (email, SSN, credit_card) this:

• Flows into LLM context (shipped to model providers, including Altimate backend)
• Appears in session transcripts / Recap traces on disk
• Is not redacted or gated

Short-term mitigation (shipped in 0.5.22): tool description + permission prompt warns users; recommends algorithm='profile' for PII-bearing tables.

Proper fix (this issue):

1. Add include_sample_rows: boolean param (default false OR default true with a config flag)
2. If false, strip diff_rows[].values before returning, keep counts
3. Optional: integrate with schema.detect_pii (if available) to gate automatically
4. Document in the data-parity skill

Deferred because: requires a product policy decision on the default (ship safe vs ship useful) and a compat path for existing skill users.

[umudhasanli]

include_sample_rows: false is the strongest default here. For users who explicitly enable samples, a second boundary before tool output enters the model/transcript can still preserve useful non-PII columns. Flare Redact can recursively sanitize diff_rows[].values while keeping the surrounding result shape and counts intact.

A compiled policy can cover deterministic identifiers plus enable: ['contextual'] for labelled names/addresses/DOBs; schema column names can be fed into redactKeys, and a local semantic detector can be added for domain-specific or multilingual PII. I would apply the same policy before both model return and Recap persistence, then use value-free scan() findings in tests to prove raw samples do not cross either boundary.

That gives a safe default, an explicit compatibility path, and defense in depth when sampling is intentionally enabled.

Disclosure: I maintain Flare Redact: https://github.com/flare-collection/flare-redact