Fix PDF OCR review blockers

[ajroetker]

Stacked on the exact current head reported by #366 (01c28ba). The author fork branch was force-reset to a partial, diverged history, so aj/pr366-review-base preserves that reviewed head as the comparison base.

Fixes the concrete review blockers identified on #366:

• Enforce the ASCII85 decoded-byte budget before each output growth.
• Validate predictor parameters with checked arithmetic and bound rows before allocation.
• Scope producer_json redaction to enrichment configurations while preserving legitimate document schema properties.
• Move file-descriptor limit mechanics into antfly_platform and classify every server command from one enum, including lite and ha.
• Name the stable source hash prefix source_fingerprint throughout profiling rather than correlation_id/source_sha256.

Validation:

• zig build lib-pdf-test
• zig build lib-readers-test
• targeted metadata, asset runtime, enrichment runtime, inference, and antfly-main tests
• native and Windows compile checks for the platform process abstraction

The larger generic processing-stage and derivation-provenance API redesign is intentionally left for a separate coordinated schema migration; this follow-up stays backward-compatible and focused on the correctness, security, and bounded design fixes.