fix(reliability): redact hostile toolbar image conversion failures

[seonghobae]

Buyer-visible toolbar image-ingress boundary

Existing Draft PR #158 is the sole current writer for src/components/Toolbar.tsx. Its local image picker catches unknown failures from imageFileToInlineDataUri() and forwards the caught value directly to host onImageError. File/Blob conversion crosses caller/platform-controlled capabilities (for example an overridden arrayBuffer()), so a hostile thrown object or Proxy can escape Inkspan's stable diagnostic boundary and execute caller-controlled behavior when the host inspects it.

This remains Inkspan-owned local error containment only. It adds no transport, persistence, authentication, authorization, tenancy, credentials, migration, retention, deployment, model/provider, network, durable audit, or durable PDF authority.

Test-first acceptance

1. Continue only on existing Draft PR fix(reliability): fail closed for stale toolbar image uploads #158 / branch fix/toolbar-image-lifecycle-20260811; do not create a competing Toolbar.tsx writer. Freeze if that exact branch/path moves independently.
2. RED through the real toolbar file input: use a genuine image File whose conversion capability rejects with a hostile Proxy carrying private traps. Require the picker to contain the failure, never expose the hostile value to onImageError, avoid the alt-text prompt and document mutation, and report exactly one stable payload-redacted Error.
3. GREEN without inspecting, stringifying, coercing, enumerating, or traversing the prototype of unknown caught values. Preserve the existing deterministic oversize diagnostic, accepted image conversion, image configuration, lifecycle/read-only checks, alternative-text intent, same-file reselection, and host callback ownership.
4. Reacquire exact-head 100% owned-production statement/branch/function/line coverage, packed-package, Chromium/Firefox/WebKit, Office Python 3.11–3.14, Security Scan, SAST, and applicable central required-workflow evidence.

Integration boundary

Keep #158 Draft/unmerged while #118 owns the unchanged protected v0.6.0 publication/provenance source identity. Any head/live-base movement invalidates predecessor evidence.

[seonghobae]

Resolved on the existing sole writer PR #158, not on protected main. Exact RED 6e767611315e7427f9c7b1c5018cc81aab200413 added the real toolbar file-input hostile-Proxy regression and CI 31925079409 failed as intended. The narrow GREEN repair 84cb2b1e5fb94b587bf29dd9024c5288f54c7636 stopped forwarding unknown conversion throw values, preflighted genuine Blob size intrinsically, and emits only the stable redacted Error('Image processing failed.'). Current #158 head 0693ba351c2b325e59e45a41e36c861800b1f732 still contains that repair and regression; exact-head CI 31933724549, Security Scan 31933724626, SAST 31933724588, OpenCode, Noema, and Strix are completed/success. #158 remains Draft/unmerged because #118 freezes protected main for v0.6.0 publication, so this closure records active-PR completion rather than shipped protected-main truth.