feat: add universal artifact intake and extraction

[szmyty]

Summary

• add the stable renderflow.intake/v1 contract for arbitrary binary-safe source identity, multi-signal detection, explicit conflicts, provenance-aware metadata, available operations, and unknown-format reporting
• add provider-driven native/ZIP inspection plus parent-linked ZIP, EPUB, DOCX, and CBZ extraction into the normal content-addressed artifact store
• enforce recursive depth, artifact-count, extracted-byte, and expansion-ratio budgets; reject traversal paths, absolute paths, symlinks, and encrypted entries without explicit policy
• expose intake through renderflow inspect --input ..., Engine::inspect_artifact, provider capability discovery, and a published JSON Schema
• run intake before canonical path planning, freeze source artifact evidence into the execution plan, and reject source changes before transforms execute
• document the CLI, SDK/provider seam, graph handoff, metadata provenance, and extraction safety model

Verification

• cargo check --workspace --all-targets --locked
• changed Rust files pass rustfmt --check
• git diff --check
• JSON schemas parse with jq
• real CLI smoke assertions for unknown binary reporting, conflicting extension/media/magic resolution, ZIP child extraction and parent lineage, recursive budgets, and pre-planning source artifact evidence

Per the current sprint convention, the full test suite, Clippy, and CI matrix were not run and can be covered by the follow-up hardening issue.

Closes #365

[devactivity-app]

Pull Request Summary by devActivity

Metrics

Achievements

• @szmyty
  Earned XP: 15⭐
  Check Your Progress