Add Phase 3 orchestration source collectors

[paullizer]

Summary

• add a generic EvidenceCollectorResult contract and adapters for authorized conversation history, prior lineage, selected and conversation-upload documents, workspace search, Web Search, Source Review, Deep Research, and selected images
• populate the shared evidence ledger from existing retrieval outputs before streaming finalization, with explicit no-result, failure, skipped, partial, and unauthorized states
• revalidate selected-document access at the collector boundary, omit prompt-injection-flagged page excerpts from supported facts, and keep compact image evidence free of raw bytes and signed URLs
• update orchestration documentation, release notes, and application version to 0.250.060

Scope

• keeps existing retrieval and authorization systems in place; collectors normalize their already-authorized outputs
• persists populated ledgers for streaming chat and Analyze/Compare paths
• injects a bounded populated ledger into streaming finalizer context
• leaves selected agent/action executor normalization to Phase 4

Validation

• test_chat_evidence_collectors.py: 15/15
• test_chat_evidence_ledger.py: 9/9
• test_chat_turn_orchestration_plan.py: 15/15
• test_image_proposal_pipeline.py: 3/3
• test_chat_streaming_sse_metadata_fix.py: 3/3
• route policy tests: 12/12
• Python py_compile
• full-file broken-access-control and XSS guardrails
• CRLF-safe git diff --check

Refs #1021