fix(reliability): contain hostile image conversion throw values

[seonghobae]

Buyer-visible image-ingress failure-containment boundary

Draft PR #155 is the sole current writer for src/extensions/Base64Image.ts. Its paste/drop image path catches failures from imageFileToInlineDataUri() and classifies the unknown thrown value with error instanceof Error before invoking the host onError callback. File/Blob conversion crosses caller/platform-controlled capabilities (for example an overridden arrayBuffer()), so a hostile thrown Proxy can make that instanceof classification execute its getPrototypeOf trap and leak a private sentinel as an unhandled rejection instead of producing Inkspan's stable failure contract.

This is Inkspan-owned local error containment only. It adds no transport, persistence, authn/authz, tenancy, credentials, network, model/provider, deployment, migration, retention, or durable-audit authority.

Test-first acceptance

1. Continue only on existing Draft PR fix(a11y): require image alt intent on paste and drop #155 / branch fix/image-ingress-alt-intent-20260811; do not create a competing Base64Image.ts writer. Freeze if that exact branch/path moves independently.
2. RED through the real public paste handler: use a genuine image File whose conversion capability rejects with a Proxy whose getPrototypeOf trap throws a distinctive private sentinel. Require the paste path to contain the failure, never execute the hostile prototype trap, avoid document mutation, and report one stable payload-redacted Error to configured onError.
3. GREEN without inspecting, stringifying, coercing, enumerating, or traversing the prototype of unknown caught values at the async file-conversion boundary. Preserve accepted image conversion, source-order/alt-intent semantics, cancellation, read-only/destroyed-editor behavior, and existing internal validation diagnostics outside this untrusted conversion boundary.
4. Maintain exact 100% owned-production statement/branch/function/line coverage plus packed-package, Chromium/Firefox/WebKit, Office Python 3.11–3.14, Security Scan, SAST, and applicable central required-workflow evidence on the final unchanged head.

Integration boundary

Keep #155 Draft/unmerged while #118 owns the unchanged protected v0.6.0 publication/provenance source identity. Any head/live-base movement invalidates predecessor evidence.