[E13–S9 11/15] Add document processing and rendition views to the TUI

[salmonumbrella]

What changed

• Adds a document-processing view to the TUI for the exact selected file version, with profile switching, reviewed provider flow, disclosed and retained classes, backup consequences, and independent rendition and embedding coverage.
• Adds an explicit build action and bounded status refresh. Consent-required processing first shows the complete hosted or operator-network boundary and sends nothing until the operator confirms it.
• Adds a verified, size-bounded sanitized Markdown view with attachment, build, artifact, checksum, completeness, and warning metadata.
• Adds source-fenced search for the selected version, including the actual retrieval mode, degradations, evidence provenance, and direct-file results without fabricated excerpts.
• Carries the merged R1 provider contract through the later rendition adapters: exact-byte upload ownership, request-bound receipts, synthetic filenames unless original-name disclosure is explicit, bounded results, and sanitized provider errors.

Why

The terminal interface could browse documents but could not inspect or run their processing flow, follow coverage and job state, read the retained rendition, or understand degraded retrieval. This gives terminal users the same exact-version processing boundary as the API, CLI, and web app without putting provider configuration inside the TUI or turning one keypress into implicit consent.

The R1 contract also landed on main while this stack was in progress. Reapplying it at the current stack head exposed older adapter assumptions, so this PR updates those adapters rather than regressing the merged exact-byte and disclosure guarantees.

Usage

Select a file and press P to open document processing. Use [ and ] to switch profiles, b to build the reviewed plan, and r to refresh coverage and the current job. Consent-required plans show a confirmation before any provider work begins. Press R to read the active verified rendition or / to search retained evidence for that exact version.

The capture is from the real TUI against synthetic data and shows the consent boundary before hosted processing begins.

Refs #176

Stacks on #234.

[roborev-ci]

roborev: Combined Review (afa1b22)

Verdict: One medium-severity issue requires attention.

Medium

• internal/processing/service.go:469-484 — When a profile runs both rendition and embedding stages, the initial notification is emitted with an empty EmbeddingJobIDs slice, and later notifications are discarded. API clients therefore receive an aggregate job missing the embedding jobs created. Publish the initial job only after all stage jobs are enqueued, including complete rendition and embedding IDs.

---

Reviewers: 2 done | Synthesis: codex, 6s | Total: 19m11s