Add a HIPAA Safe Harbor attestation report generator

[maziyarpanahi]

Description

Adds a local HIPAA Safe Harbor attestation generator over PHI-safe de-identification audit reports. The artifact enumerates all 18 identifier categories, maps canonical labels and policy actions, aggregates detections and applied actions, flags uncovered or kept categories for expert review, and binds the result to verified source and attestation hashes without exposing span content.

Type of Change

• New feature
• Documentation update
• Test addition/improvement

Changes Made

• Added the Safe Harbor category mapping and deterministic attestation schema.
• Added openmed compliance safe-harbor for offline JSON generation, including the uniform --json command envelope.
• Rejects forged audit-report hashes and keeps untrusted audit fields out of user-facing errors.
• Added privacy, integrity, residual-risk, mapping, and CLI coverage.
• Added usage and coverage documentation to the docs navigation.

Testing

• .venv/bin/python -m pytest tests/ -q — 6111 passed, 48 skipped
• Focused audit/compliance/CLI suite — 41 passed
• make format
• make lint
• make format-check
• make type-check
• make docs-build
• python3 -m build
• Scoped pre-commit validation for all PR files

Documentation

• Added the HIPAA Safe Harbor attestation guide.
• Added Google-style docstrings for the public API.
• No changelog update required for this focused feature PR.

Dependencies

• No new dependencies.

Related Issues

Closes #872

Screenshots/Examples

The documentation includes offline CLI examples and the emitted JSON contract.

[maziyarpanahi]

Ready to merge after maintainer validation. I rebased this onto the current master and tightened the compliance path so forged audit hashes are rejected, malformed audit fields cannot leak through errors, and the command follows the uniform JSON/error contract. The full local suite passed (6,111 passed, 48 skipped), focused coverage passed (41 tests), strict docs/package/lint/type/pre-commit gates passed, and the fresh hosted matrix is fully green including both container architectures. Squash-merging now.