[0.4.0-C] Provider boundary, injection defense, provenance, and evaluation

[mberrys]

Optional model inference behind a replaceable boundary. PDF content is data, never instruction. No-provider mode remains required.

Depends on #53. Related: #34, #159.