IMP-070: add explicit local portability review workflow

[badjoke-lab]

Summary

Start IMP-070 to add one explicit local-model review path for an existing import batch, its exact mapping report, and only linked portability-loss records.

Intended boundary

• caller selects one import batch explicitly;
• mapping and loss records are resolved by exact stored links only;
• original source bytes, source payloads, canonical conversation content, source hashes, source-object IDs, quarantine details, paths, credentials, and secrets are excluded;
• one bounded deterministic snapshot enters only as data-only external_content through retriever / retrieval;
• the current user request remains the only task authority;
• no import approval, retry, rollback, mutation, automatic discovery, semantic retrieval, tools, capabilities, network, cloud path, or model-selected records;
• no schema or State Package change.

Verification plan

• successful exact review;
• linked-loss-only selection;
• task-versus-material channel separation;
• hostile selected text authority denial;
• malformed, mismatched, archived, secret, over-limit, duplicate, and unavailable-target rejection;
• runtime-failure revision preservation;
• content-free public result;
• Ubuntu, macOS, Windows, quality, mypy, coverage, generated-spec, public-status, and numbering checks.

Evidence boundary

IMP-070 is CI-only unless a separate exact-commit real-machine acceptance is scheduled. Complete Phase 6, Lite v1.0, and stable general anti-lock-in remain incomplete.

Closes #223

[cloudflare-workers-and-pages]

Deploying doll-bjl with    Cloudflare Pages

Latest commit:	a6ff710
Status:	✅  Deploy successful!
Preview URL:	https://02c6d2af.doll-bjl.pages.dev
Branch Preview URL:	https://imp-070-explicit-local-porta.doll-bjl.pages.dev

View logs