Add explicitly configured local OCR proposal workflow

[silverstein]

Summary

Adds an experimental, explicitly configured propose_pdf_ocr workflow for a separately installed macOS Vision adapter. Default discovery remains exactly 57 tools with the existing contract digest; OCR appears only after a user supplies localOCR in local configuration. No OCR engine, Python helper, installer or automatic package download is included in the extension.

The tool requires one page, the exact source identity and explicit confirmation. It snapshots source/helper bytes, retains a private proposal, replays the page image, and returns words as unverified proposals with an offline review. It does not edit PDFs or replace native text. Returned, observed and omitted counts are separate.

Verification

Independent adversarial review accepted exact head b50e12f51b7cbc7ef542d20b45f757a33c119dbd for source integration after fixes to output-schema coverage and ordinary-completion process cleanup. The helper explicitly refuses encrypted PDFs, including those with an empty user password.

The first full CI on ae3bf4e1 failed in native-suite expectations, default-versus-optional documentation, static scorer imports and source-bound oracle metadata. Reviewed successor 3fb93639e23b7586c3ae18bfd779d9cc1eb89173 corrects those. The OCR wire schema is byte-identical, the adapter is unchanged except removal of the moved schema block, and all eight oracle cases remain byte-identical. Scorer role lists, closure checks, score logic and tolerances are unchanged. Both full CI gates in run 36747949941 passed: Node 20.19 (33m28s) and Node 22.12 (34m34s), each 3,664 Vitest tests passed with 168 intentional skips, plus 20 Python checks, 25 OCR process checks, share contract, reproducible build and packaged smoke. The failed predecessor is not green evidence.

Exact successor Mac verification: 209/209 across eight Vitest files, 25/25 wrapper tests, two reproducible clean MCPB builds (72,801,935 bytes, SHA-256 c62e7f8c48bd32274026c01ad815fe5db3dd2d63aee1ce5724ab14f97b95beaf) and the packed smoke pass. Independent source-delta acceptance confirms unchanged wire schema, all eight oracle case bodies and static module closure.

• Linux Node 22.22.3: 25/25 wrapper checks and 20/20 dependency-free Python checks.
• macOS arm64 Node 22.23.2: the same 25/25 and 20/20, plus 82/82 output-schema, MCP contract and packaging-inventory checks.
• Actual isolated macOS MCP run: default 57 tools; configured 58 tools; 119 unverified observations with exact source/render replay. Missing confirmation and stale source reject before output. A valid AESv3-encrypted fixture with an empty user password rejects without a completed proposal. Source bytes remain unchanged.
• Refreshed source and unpacked successor runs again return identical 119-observation proposals, page images and review files. Independent saved-evidence audit rehashed the bindings and all 36 checked runtime files. A fresh first-party two-page raster-only synthetic fixture has zero native text items and returns all six known literal lines on each page, with distinct page images and unchanged input. This is narrow functional evidence, not general OCR accuracy or installed desktop qualification.
• Source/share runtime bytes match. Public CI includes the wrapper and helper checks in addition to existing test, share, build and packed-smoke gates.

Boundaries

This is source integration, not a public OCR release or installed Claude Desktop qualification. The administrator-selected Python environment remains trusted. Confidence is uncalibrated: the existing scan includes a wrong word at score 1.0. Windows/Linux do not run this macOS adapter. No host restart, provider calls, PDF mutation or user analytics were added.