fix(uploads): scan before parse; drop ungated URL/HF originals (ADR-0011)

fix(uploads): make the deployed malware-scan posture explicit and honest

style: apply ruff lint --fix + ruff format across the tree

feat(uploads): local content scan + manifest drafting (ADR-0011)

feat(uploads): ADR-0011 manual-upload safety gate ("Now" slice)