fix(reliability): redact hostile toolbar image conversion failures #356

Buyer-visible toolbar image-ingress boundary

Existing Draft PR #158 is the sole current writer for src/components/Toolbar.tsx. Its local image picker catches unknown failures from imageFileToInlineDataUri() and forwards the caught value directly to host onImageError. File/Blob conversion crosses caller/platform-controlled capabilities (for example an overridden arrayBuffer()), so a hostile thrown object or Proxy can escape Inkspan's stable diagnostic boundary and execute caller-controlled behavior when the host inspects it.

This remains Inkspan-owned local error containment only. It adds no transport, persistence, authentication, authorization, tenancy, credentials, migration, retention, deployment, model/provider, network, durable audit, or durable PDF authority.

Test-first acceptance

1. Continue only on existing Draft PR fix(reliability): fail closed for stale toolbar image uploads #158 / branch fix/toolbar-image-lifecycle-20260811; do not create a competing Toolbar.tsx writer. Freeze if that exact branch/path moves independently.
2. RED through the real toolbar file input: use a genuine image File whose conversion capability rejects with a hostile Proxy carrying private traps. Require the picker to contain the failure, never expose the hostile value to onImageError, avoid the alt-text prompt and document mutation, and report exactly one stable payload-redacted Error.
3. GREEN without inspecting, stringifying, coercing, enumerating, or traversing the prototype of unknown caught values. Preserve the existing deterministic oversize diagnostic, accepted image conversion, image configuration, lifecycle/read-only checks, alternative-text intent, same-file reselection, and host callback ownership.
4. Reacquire exact-head 100% owned-production statement/branch/function/line coverage, packed-package, Chromium/Firefox/WebKit, Office Python 3.11–3.14, Security Scan, SAST, and applicable central required-workflow evidence.

Integration boundary

Keep #158 Draft/unmerged while #118 owns the unchanged protected v0.6.0 publication/provenance source identity. Any head/live-base movement invalidates predecessor evidence.