Add qualification-only image recipe provider

[dovvnloading]

Summary

• add a qualification-only fixed-function image provider for validated PNG/JPEG/WebP bytes
• enforce Pillow verify/load, one-frame policy, decompression/resource limits, fixed transforms, metadata stripping, output revalidation, hashing, and cancellation
• keep provider startup disabled until an external sandbox RuntimeHealth result passes
• pin Pillow 12.3 and document the provider qualification ADR, limits, failure taxonomy, and remaining OS sandbox gate

Scope

This is intentionally stacked on the trusted artifact-boundary stage (#41). It does not launch processes, create AppContainers/LPAC or Job Objects, use the native broker, expose a lifecycle/API route, or enable production execution.

Validation

• Pillow 12.3.0 installed locally
• python -m pytest tests/test_phase2_recipe_provider.py -q (17 passed)
• python -m pytest -q (204 passed, 1 platform skip, 1 pre-existing warning)
• python -m compileall -q backend\\cortex_backend\\execution tests
• python tools/generate_contracts.py
• git diff --check
• frontend lint, typecheck, production build, and 39 frontend tests passed

The unrelated working-tree edit to Cortex.pyproj was intentionally not included.

[dovvnloading]

Retargeting to main to trigger repository Quality; reopening immediately.