feat(pptx): bounded OOXML semantic ingestion with media and cache safety

[skilfoy]

Summary

First-class PowerPoint (.pptx) semantic ingestion via a dedicated bounded OOXML converter (no python-pptx runtime dependency).

• Preserves slide order, sections, hidden state, text/bullets, speaker notes, comments, tables, chart data, SmartArt/relationships, hyperlinks, alt text, layout & master evidence.
• Extracts images → vision pipeline, embedded audio/video → transcription (with content/SHA/model/prompt/path-aware cache keys, force support, and failed-media retry).
• Hardened security: defusedxml (DTD/entity/UTF-16 rejection), XML depth/element/byte limits, converter cache binds full PresentationLimits + verifies artifact hashes/sizes/kind on load (treats cache as untrusted).
• Proper incremental + clustered liveness for generated transcripts.
• Custom --out roots honored for PPTX bundles and derivatives.
• Nested PPTX and unsupported rasters (e.g. BMP) kept inert.
• Watch parity for top-level media.
• Agent/skill transcription workflows updated (all hosts) for the new cache and output model.
• Comprehensive adversarial + regression tests (routing safety, cache tampering, DTD, incremental preservation, provenance, etc.).

Addresses #1573.
Supersedes the narrower text-only approach in #1821.

Testing (done before approval)

• Targeted PPTX + transcript + extract + watch + skillgen: 209 passed
• Full suite (excluding known MCP HTTP tests): 3584 passed, 32 skipped. Only 4 unrelated failures (ollama tests that require the openai package).
• Ruff, git diff --check, py_compile: clean.
• Security scan (bandit) on new code: only low-severity expected items.
• Real adversarial fixtures (rich decks with media, attachments, charts, notes) + limit tests + cache poisoning + DTD attacks.

What the upgrade to modern Python will unlock (next work)

User has approved moving this PR forward as-is. Follow-up work will raise the minimum Python version (3.10 EOL is imminent) to deliver unconditional high-quality local video transcription and other modern improvements critical for video archive knowledge bases.

Checklist

• Tests pass
• Static checks pass
• Security & cache hardening verified
• CI (will run on PR)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.