fix(privacy): drop nvidia-bug-report / dmidecode false positives

- Allowlist nvidia.com, mellanox.com, gnu.org, debian.org, ubuntu.com; the
  common "not specified / not available" FRU placeholders.
- Reject matches with no alphanumeric or <2 chars (stray ":" from a dumped
  resolv line), fru_location values that echo the field name ("Base Board
  Asset Tag", "P1-DIMMA1_AssetTag"), IPv4 embedded in a version string
  ("18:6.1.4.5"), and e-mail on kernel ring-buffer lines (driver copyright).
- Customer guess: don't report a single-hit low-confidence domain at all -
  "unidentified" beats guessing nvidia.com from a driver comment.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

bible-local/docs/privacy-scan.md

@@ -47,6 +47,13 @@ via `parser.PrivacyScanEnabled()`.
   a `resolv` finding, not also a `domain` one).
 - A match that parses as an IP but is not sensitive (see IP policy) is dropped
   regardless of the rule that produced it.
+- Noise guards: matches shorter than 2 chars or with no alphanumeric are
+  dropped; `fru_location` values that echo the field name (`Base Board Asset
+  Tag`, `P1-DIMMA1_AssetTag`) are dropped; IPv4 inside a longer dotted-number
+  run (`18:6.1.4.5`) is not an address; e-mail on a kernel ring-buffer line
+  (`[   8.07] ...`) is driver/copyright text, not customer contact.
+- Customer guess: a single-hit low-confidence domain is not reported at all
+  (better "unidentified" than guessing `nvidia.com` from a driver comment).
 
 ## Rule catalogue (`rules.go`)