pub fn apply(raw: &str) -> String
Wrap a tool result with the edge-redact header so the cloud model always sees a clear privacy receipt at the top of the response.