feat(cloning): per-run random hash salt + GDPR pseudonymization guidance

[rokde]

Summary

• Apply a per-run random salt (`bin2hex(random_bytes(32))`) when the hash strategy omits an explicit `salt`, so hashed values are unlinkable across runs (GDPR Art. 4 Nr. 5 / Recital 26).
• Make `salt` optional in the cloning YAML schema and validator; persist the generated salt on the writer side so the run is reproducible within itself.
• Document the GDPR rationale, the per-run salt behavior, and the optional-salt schema change across `docs/cloning-yaml.md`, `specs/PRD-cloning-yaml-schema.md`, and `specs/PRD-pii-matchers.md`.

Test plan

• `composer test` green
• `clonio cloning:run` on a config with hash strategy and no salt produces stable, non-replayable hashes
• Two runs of the same config without explicit salt produce different hash outputs

🤖 Generated with Claude Code