feat(rag): make grounded onboarding safe by default

[bsbodden]

Summary

• add GroundedRagPrompt to screen retrieved evidence before exposing canonical prompt text
• make the benchmark renderer delegate to the production prompt contract without changing its prompt bytes
• prepare the 0.2.3 version/docs and correct stale Gemma 4 qualification copy

Verification

• ./gradlew check (132 tasks)
• ./gradlew javadoc
• focused models-rag and models-rag-bench tests, including canonical prompt and rejection coverage