Improve Vahter triage and configure licensed ImageSharp builds

[Szer]

Summary

Message triage can mistake contextual replies for spam and overlook disguised promotion. Apply the pattern-aware moderation policy: judge the current message, allow on-topic community announcements, distinguish new-user probes from meaningful replies, and recognize document-service bait, vague paid-work offers, endorsements, profile advertising and obfuscated drug offers.

Supply the reply parent and the latest four retained sender messages inside the untrusted-data fence. Each context item is capped at 1,000 characters. Use the prior retained DB message count rather than the capped unique-text count used by ML. The indexed context lookup runs only on an uncached LLM escalation, has a two-second timeout, and excludes the current message. Keep the SPAM / NOT_SPAM / SKIP schema and model/request settings unchanged.

The migration clears text-verdict cache rows so the previous policy's decisions are not retained for their full TTL. Reaction-triage cache rows remain intact.

Validation

• Vahter LLM integration tests: 52 passed, including bounded history, reply fencing and truncation.
• Vahter container-free tests: 133 passed.
• Mandatory comment-ratio hook and diff whitespace checks passed.
• Fresh solution restore passed with NuGet auditing enabled.
• Licensed CouponHubBot Release build, all 45 OCR tests, and all 264 integration tests passed.
• CouponHubBot dependency audit, including transitive packages: no known vulnerabilities reported.
• Exported runtime image scan found no license contents or signature.
• Shared container builder: all 133 Fizruk tests and all 15 MultiPod tests passed.
• Workflow actionlint validation passed.

Licensed ImageSharp security update

Upgrade ImageSharp to 4.1.3 and its ZXing binding to the ImageSharp V4 package. Read the complete license from the SIXLABORS_LICENSE_KEY GitHub Actions secret for host builds and pass it through a build secret mount for container publishing.

Wire the secret into Coupon and MultiPod CI, Coupon deployment, and the manual Coupon test workflow. Bot test images use the Docker/Podman CLI because the Testcontainers build API does not provide build-secret mounts; retain process-wide image-build deduplication and captured build logs. The development Compose build uses the same secret. No license value is committed or passed as a build argument.

Scope

This implements the policy selected from the private moderation replay, with generic examples rather than identifiable review records. Live context uses the latest retained messages; the replay used historical snapshots, so its accuracy and latency figures are not an exact validation of this integration. No private dataset is included, no production setting has been changed, and no model switch is included.