Phase 1: add authorized mixed-source manifest contracts

[Paul Lizer (paullizer)]

Summary

• Add one ordered, authorization-safe mixed-source manifest for personal, group, public, and chat-upload documents.
• Classify and independently partition tabular, narrative, unsupported, and unresolved sources without allowing one invalid source to erase valid cohorts.
• Add validated selected, all, history, and relevance selection modes plus a strict, bounded engine-neutral evidence envelope.
• Add aggregate-only diagnostics, a 100-source request bound, duplicate-ID removal, and one request-scoped authorization snapshot.
• Add a default-off shadow integration for Chat and workflows while preserving all existing Chat, Search, Analyze, and Compare execution behavior.
• Harden chat-upload source resolution with conversation ownership validation and projected metadata queries that do not read embedded content or blob data.
• Bump the application version to 0.250.062 and add feature documentation and release notes.

Security

• Revalidates personal ownership or approved sharing, current group membership, public workspace visibility, and chat conversation ownership at the object boundary.
• Ignores caller-supplied scope and identity metadata.
• Returns the same scrubbed unresolved shape for missing and unauthorized sources to avoid an enumeration oracle.
• Keeps document IDs, filenames, content, blob paths, credentials, and raw configuration out of diagnostics.

Scope

This PR implements Phase 1 contracts only. It does not change document-search activation, mixed Analyze execution, cross-format Compare, follow-up grounding behavior, or rollout defaults. Those remain scoped to #1057-#1061.

Validation

• 14 passed across the focused Phase 1 behavioral suites.
• Python compilation passed for all changed Python files.
• Route policy guardrails passed: 12/12.
• Full-file broken-access-control and XSS scans passed for all changed application modules.
• Editor diagnostics were clean.
• CRLF-aware git diff --check passed.
• Independent final code review reported no findings.

Two neighboring legacy tests contain stale version/app-registration assertions already inconsistent with the requested base branch; their functional resolver checks passed and they were not changed here.

Fixes#1056
Refs #1055

[Paul Lizer (paullizer)]

Superseded by #1064. Two unrelated migration-state deletions were committed concurrently to this PR's head branch after the scoped #1056 commit. The concurrent commit remains preserved on feature/1056-authorized-source-manifest; #1064 uses a clean branch at commit aea82a4 and contains only the ten Phase 1 files.