Harden mixed-source orchestration and CSV exports

[Paul Lizer (paullizer)]

Summary

• Complete Phase 6 mixed-source hardening: manifest-aligned terminal coverage, mode-specific partial-failure handling, cancellation/finalization rollback, strict fresh authorization/version checks, and aggregate-only development telemetry.
• Add bounded, approved-access Analyze All enumeration behind the existing default-off flag and keep Chat/Search relevance-bounded.
• Preserve Foundry document-context opt-out, deduplicate mixed citations/artifacts, aggregate observed native tabular token usage, and extract the reusable tabular invocation-slicing helper with a route compatibility shim.
• Improve durable background CSV export throughput and timeout recovery while preserving checkpointing, authorization, and idempotent publication.

Validation

• 53 Phase 1-6 mixed-source contract tests passed.
• 67 adjacent token, artifact, stream, Foundry, and metadata regressions passed.
• Route-policy, BAC, XSS, Python compilation, Pylance diagnostics, JavaScript syntax, and whitespace checks passed.

Rollout

All mixed-source behavior flags, subordinate rollout flags, and development telemetry remain default off pending production evidence and explicit approval.

Fixes#1061
Refs #1055
Refs #1071