Add processed-payload telemetry and prompt duplicate shadow

[SecretSettler]

Summary

• Add metadata-only before/after processed-payload char counters to ContextPilot telemetry
• Add opt-in tokenizer-based before/after token counters; tokenizer measurement is off by default and no fake token numbers are emitted when unavailable
• Label legacy chars/4 values as derived, not actual tokens, across savings script/docs/reports
• Add advisory-only system/skill prompt duplicate shadow section to the Hermes opportunity analyzer
• No new replacement, summarization, routing, or prompt rewriting behavior

Verification

• python3 -m pytest tests/test_hermes_plugin_patch.py tests/test_hermes_context_opportunity_analyzer.py tests/test_contextpilot_savings.py tests/test_contextpilot_savings_skill.py tests/test_hermes_contextpilot_monitor.py -q
• python3 -m pytest -q
• python3 scripts/analyze_hermes_context_opportunities.py --since-hours 24 --out-dir /tmp/contextpilot_actual_prompt_check --date actual_prompt_check --top-n 5
• python3 scripts/contextpilot_savings.py --since-hours 24
• Claude Code read-only final review: APPROVE, no blockers

Stacked on PR #52 (modular analyzer refactor).