Add PII payload filter to goose-proxy

[BryanChasko]

Agent Task

Agent: kade-vox-gander-security
Depends on: none
Branch: feat/proxy-pii-filter
Source: specs/marvel-snap-pipeline/tasks.md

Acceptance Criteria

• Reject outbound payloads matching PII patterns (email, phone, address, account ID)
• Log rejections with CSWR metadata
• Return clear error to calling agent

---

Generated from specs/marvel-snap-pipeline/tasks.md by generate-task-issues.py