Add alerting, PII, tamper-evident & sampling

[nikhilvdev]

Adds a set of Phase 4 plugin features and safety fixes:

• AlertingPlugin base + Slack/PagerDuty/Email concrete plugins (dedup, background send, bounded tracking).
• PIIRedactPlugin: regex-based (and optional Presidio) PII redaction over meta values, cycle/depth-bounded.
• TamperEvidentPlugin: SHA-256 hash-chaining per-record + verify_chain helper.
• SamplingPlugin: tail-based elevation by trace_id (buffered, bounded, flush-to-transports).
• Plugin.FunctionPlugin + Logger.use() accepts plain functions as middleware.
• Logger: catch transport.format/write errors and log them instead of raising.
• Version bump to 0.3.0, README and CHANGELOG updates, pyproject optional deps (presidio) and dev deps (hypothesis).
• Extensive tests for the new plugins and property-based pipeline robustness.

These changes add feature-complete plugin behavior, safety bounds, and tests for adversarial meta inputs.

Summary

Checklist

• ruff check . passes
• mypy logquill passes (--strict on the public API)
• pytest passes, and new surface area has test coverage
• Public API additions are documented in README.md with a runnable example
• CHANGELOG.md has an entry under Unreleased
• If this touches the cross-language contract (levels, logger methods,
  record shape, transport/plugin contracts, config shape) shared with
  logquill-js, a matching tracking issue/PR is opened there

Scope