fix: confine media and sanitize reports

[jason-allen-oneal]

Summary

• bind pack-provided media resolution to explicit pack roots
• reject root escapes, symlink escapes, non-image payloads, and images over 10 MiB
• preserve generated OCR media through an explicit trusted output root
• apply configured redaction to complete Markdown and JSON report data
• replace literal redaction expressions and prior labels with opaque IDs and counts

Root cause

Media markers were resolved directly from prompt-controlled paths, while report redaction covered only selected trace fields and retained raw pattern metadata.

Security and compatibility impact

Pack media is now confined to the pack directory. Programmatic media cases must explicitly allow their media root. Generated OCR cases continue to work. Configured redaction now covers pack data, tool calls, metadata, errors, evaluations, and prior redaction records without mutating caller-owned models.

Verification

HEAD: 93a3cac

• .venv/bin/ruff check . — passed
• .venv/bin/pytest -q tests/test_adapters.py tests/test_core.py tests/test_evaluator_v2.py — 45 passed
• .venv/bin/pytest --cov=darkprompt --cov-report=term-missing — 63 passed, 89.24% coverage
• .venv/bin/python -m build — sdist and wheel built
• git diff --check — passed
• focused safe-canary proof — outside-root media blocked, in-root media allowed, configured secret absent from JSON, opaque redaction IDs retained

No live provider API calls were made.