[P0] Lock down developer commands and privacy handling

[apple050620312]

Summary

• Disable developer commands by default and require both an allowlisted developer guild and user ID when enabled.
• Enforce caller validation at runtime and terminate timed-out subprocesses.
• Remove message content, URLs, and upstream response bodies from telemetry and error logs.
• Align the privacy policy with Discord and EmbedEZ data flows and actual retention behavior.

Priority

P0 — closes direct host-command exposure and sensitive-data logging/privacy gaps.

Validation

• Runtime imports succeed with developer commands disabled by default.
• Developer commands are absent from the default command surface.
• All Python files pass AST parsing.