feat: export pre-copy semantic catalog candidates

[seonghobae]

Summary

• add a deterministic Rust exporter for semantic-data-portal pre-copy preview
• omit source/destination paths, filenames, cloud-root identity, account IDs, object IDs, and locators by construction
• enforce metadata-first production-time precedence and exact evidence binding
• bound exports to 200 candidates and a 2 MiB pretty-printed JSON body
• add a mutually exclusive read-only --export-semantic-catalog CLI mode

Integration

• consumer contract: feat: preview DiskSage pre-copy catalog candidates semantic-data-portal#31
• ontology foundation: feat: add standards-based hybrid file ontology semantic-data-portal#28
• stacked DiskSage base: feat: export redacted capacity evidence for Naruon #86

The batch still contains private embedded content metadata and must be sent only to an approved portal endpoint. The portal response does not echo that content and explicitly does not authorize copy, persistence, or eviction.

Validation

• semantic catalog Rust tests: 4 passed
• cloud CLI tests: 17 passed
• real Downloads to readable iCloud destination dry-run: 50 candidates, 4,609,040,868 bytes; portal Python contract accepted; forbidden contract keys 0
• semantic-data-portal full suite: 200 passed, 8 skipped
• git diff --check

The broad local Rust lib run reached 355 passed, 2 ignored, with 8 existing macOS temporary-directory protection failures. A representative failure reproduces unchanged on base head be57409. No user file or cloud mutation occurred.

Safety

• no LLM or network call in the exporter
• no catalog persistence
• no cloud copy/provider write/source move/source delete/local eviction
• private E2E batch deleted immediately after validation
• validation build target deleted after tests

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 5956db5b-ebef-4c9b-b8cb-63cbcc207bcc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Consumer contract is semantic-data-portal #31, stacked on ontology PR #28. The redacted real-sample E2E passed: 50 candidates, 4,609,040,868 bytes, fixed metadata precedence, zero forbidden storage-coordinate keys, and no copy/provider/source mutation.

[seonghobae]

Redacted read-only E2E evidence for the stacked integration:\n\n- Actual Downloads candidate scan: 50 candidates, 4,609,040,868 bytes\n- Production-date evidence selected by strict precedence: embedded metadata 24, explicit filename date 6, filesystem creation time 20\n- Portal result: review required 50, blocked 12; persisted/LLM/copy/eviction all false\n- Forbidden request coordinate/identifier fields: 0\n- Private response keys: 0\n- Raw ephemeral request SHA-256: 5c58e290a7c1fe53a7ec3b8a9e3ce2b36f07996ef4b5220d2594d3747d650832\n- Redacted summary SHA-256: f6878dfda6ef69045a800c9d83f907b3fa01956b9f86d99311ac231b191f97d8\n\nThe private batch existed only under a temporary local path and was deleted after validation. No cloud copy, local eviction, move, delete, provider login, or provider restart was performed. Filename dates remained auxiliary low-confidence evidence.

[seonghobae]

Naruon consumer contract is now implemented in ContextualWisdomLab/naruon#1182 (draft, stacked on Naruon #1181). It validates this PR's exact disksage.file-catalog-candidate-batch v1 shape, production-time precedence, redaction, and no-copy/no-eviction boundary without persistence or LLM calls.