Qualify trusted artifact security boundary

[dovvnloading]

Summary

This PR closes the Phase 2 artifact-security review gate for Cortex’s trusted copy-in and output-publication boundary.

What changed

• Added a deterministic, disposable artifact-boundary-review.v1 qualification probe with a fixed 12-case corpus and strict fail-closed exit behavior.
• Hardened byte-derived MIME classification to reject UTF-16/UTF-32 active markup and exponent-overflow JSON; oversized JSON integers now resolve to bounded text/plain classification instead of leaking a parser exception.
• Added stable rejection for untyped source grants and regression coverage for sparse files, link/ADS paths, active content, non-finite numbers, quarantine, rollback, and repository stored-size integrity.
• Bounded repository artifact reads by the stored size and configured maximum before hash verification.
• Added the strict artifact review command to the Windows Quality workflow.
• Updated the artifact ADR, parent ADR, evidence log, and execution-spike runbook with the completed qualification and remaining release gates.

Why

The existing boundary already enforced owner-scoped grants, stable snapshots, exact claims, quarantine, and atomic publication, but the release gate lacked a repeatable security corpus and had two fail-closed gaps: active UTF-16 markup was classified as inert binary, and JSON numeric edge cases could escape as raw ValueError/infinite floats.

Validation

• python tools/execution_spikes/artifact_security_review.py --json --strict — 12/12 passed, 0 blocked, 0 failed; corpus digest a748cc9f0a514c8d.
• python -m pytest -q — 272 passed, 1 skipped, 1 warning.
• Focused artifact tests — 24 boundary tests plus deterministic review reproducibility test passed.
• python -m compileall -q main.py backend tools tests passed.
• Generated API contract diff check passed.
• Frontend lint, typecheck, 39 tests, and production build passed.
• git diff --check passed.

Release-gate state

This closes artifact-security qualification only. Provider enablement remains blocked on resource/watchdog accounting, external security review, and production lifecycle health. No provider or arbitrary code execution is enabled by this PR.

Maintainer edits are enabled so the branch can be updated during review.