Sprint 17.C — Harden privacy and network release invariants

[maruson08]

Goal

Protect local-only processing and bounded privacy claims with high-signal release gates.

Acceptance criteria

• Audit all first-party processing network behavior across all production pages.
• Preserve no upload, analytics, telemetry, CDN, or remote-worker behavior.
• Distinguish user-initiated external navigation from processing requests.
• Keep Image and PDF metadata guarantees distinct and bounded.
• Correct concrete claim/source-link drift and add missing semantic regression checks.

[maruson08]

Completed in PR #44. Local-only CSP and runtime-network invariants passed, canonical links were corrected, and release privacy copy was narrowed to production file-content processing.