Harden context handling end to end

[RNT56]

Summary

• centralize context construction in a trust-aware canonical assembler across main chat, recursive agents, Watch, MCP sampling, Vault retrieval, cloud providers, and local MLX
• enforce scoped cloud approvals, explicit provenance, untrusted evidence boundaries, atomic tool exchanges, and protocol-safe transcript repair
• account conservatively for messages, attachments, tool schemas, hosted tools, structured output, completion reserves, and provider request options
• harden MCP sampling limits, result disclosure, temporary attachment cleanup, and tool capability handling
• preserve context lineage while excluding hidden internal rows from user-facing previews and search
• add adversarial core and app regression coverage for privacy, budgeting, malformed transcripts, tool protocol, and provider fidelity

Root cause

Context construction had evolved independently across several product surfaces. Trust, privacy, token budgeting, transcript repair, and provider-specific request accounting could therefore drift or be bypassed depending on the entry point.

Impact

Every production inference path now uses one fail-closed assembly contract. Local-only or private context requires explicit per-turn approval before cloud egress, external evidence cannot become system instructions, malformed tool exchanges cannot reach providers, and requests fail clearly instead of silently clipping required user input.

Validation

• 273 PinesCore tests passed across 17 suites
• PinesCoreTestRunner passed
• clean iOS Simulator build-for-testing passed
• Pines app tests: 115 passed, 3 physical-device-only Metal probes skipped, 0 failed
• public repository hygiene, privacy manifest, security boundary, workflow contract, secret-pattern, and generated-artifact checks passed
• git diff --check passed