Sprint 18.C — Add supported Metadata cleaning customization

[maruson08]

Acceptance: Privacy Clean stays recommended default; Customize is secondary; only secure-metadata v0.1.0 class policy and existing PDF document-info selection are exposed; no field editor; policy-specific verification remains mandatory and fail closed.

[maruson08]

Completed in #51 and merged into v2 as 1202d79.