[ilyam8]

Summary

Phase 6 (guardrails), first step. The SNMPv3 msgFlags bits were tested at 17 sites in eight spellings
(&AuthNoPriv > 0, != 0, == 0, &AuthPriv > AuthNoPriv, >= AuthPriv, != NoAuthNoPriv, ...), which differ
for a privacy-only value, so a reader could not see which flag a site meant. Two unexported predicates named after the
RFC 3412 flags, authFlag() and privFlag(), replace them; each site keeps its meaning (the authFlag, the privFlag,
both, or neither). No behavior change.

Validation

• Engine, FIPS 140-only and codec goldens unchanged; a new test pins both predicates over every security level, with
  and without Reportable, the privacy-only value included.
• 23 mutation probes (the predicate bodies widened, every converted site switched to the other flag): 20 killed; the
  other 3 cannot be told apart by any reachable input (two are excluded by validation and decoding, one only changes
  an error text).
• Both predicates inline at every call site.
• go test -race, FIPS 140-only, golangci-lint, cross-builds, govulncheck: pass locally.