Add local VLM second-opinion / consensus stage (cross-check cloud LLM against offline model)

[Liohtml]

Part of #51. Depends on #18 (local VLM provider).

Summary

Once a local, offline vision-language model provider exists (#18), add an
optional stage that runs it in parallel with the primary cloud provider
(Claude/GPT/Gemini) and produces a consensus / second-opinion comparison:
where both agree, confidence is reinforced; where they diverge, the report flags
it for the radiologist. This complements the heuristic cross-validation in #52
with a second independent model.

Why (vision)

Two independent models disagreeing on a finding is exactly the signal a reviewing
radiologist most wants surfaced. A cloud frontier model and a medical-domain
local model have different failure modes; comparing them is cheap defense in
depth. It also gives users who cannot send data to the cloud (consent gate /
offline, see #27) a fully local path that still benefits from cross-checking.

Recommended model (license-verified — corrects #18)

• Lingshu-7B — MIT license (code + weights), explicitly supports MRI
  among 12+ modalities. This is the recommended default for Add local LLaVA-Med vision model provider #18 instead of
  LLaVA-Med, whose weights are research-only ("any deployed use case —
  commercial or otherwise — is out of scope") and therefore unsuitable as a
  default in an Apache-2.0 tool. Alternatives: HuatuoGPT-Vision-7B-Qwen2.5VL
  (Apache-2.0). See comment on Add local LLaVA-Med vision model provider #18.
• Runs behind the optional local-models extra (torch + transformers).

Where

• Builds on the LocalLLMProvider from Add local LLaVA-Med vision model provider #18 (currently a stub in
  src/medcheck/llm/local.py).
• New optional step src/medcheck/pipeline/consensus.py →
  ConsensusStep(PipelineStep), OR a flag on vision_analysis to run a second
  registered provider and diff the results.
• Extend PipelineContext with second_opinion: AnalysisResult | None and a
  consensus: list[...] comparison.
• Report renderers show an "Independent model comparison" section (agreement per
  structure, divergences highlighted).

Design constraints

• Respect the external-LLM consent gate ([repo-monitor] High: Patient PHI/DICOM data transmitted to external LLM APIs without consent controls #27): the local model needs no
  consent; the cloud model already requires --allow-cloud-llm. A
  local-only consensus (e.g. two local models, or local vs. cloud only when
  consented) must be possible.
• Lazy imports; skip gracefully if local-models isn't installed (the core
  single-provider path is unaffected).
• Reuse the existing LLMRouter / call_with_retries resiliency.

Acceptance criteria

• Depends on Add local LLaVA-Med vision model provider #18 landing a working local provider (Lingshu-7B recommended).
• Optional ConsensusStep (or vision_analysis flag) compares two providers'
  structured findings and records agreements/divergences.
• Report includes an independent-comparison section when a second opinion exists.
• Honors the consent gate; supports a fully-offline consensus configuration.
• Tests with two mocked providers (agreeing case, diverging case); no real
  model download in CI.

Effort

~1 day on top of #18.

[Liohtml]

Assessment

Value: High — cross-checking a cloud LLM's findings against a local model addresses the two biggest concerns with the current architecture: hallucination risk and data sovereignty. If the two models substantially disagree, that disagreement is itself a clinically meaningful signal.

Complexity: Significant — but mostly runtime/infrastructure complexity (getting a capable local vision model running), not code complexity.

Fits architecture: Yes — another optional pipeline step. The LocalLLMProvider stub already exists in src/medcheck/llm/local.py, so the hook is there.

My take

The approach I would take for MVP:

1. Run the primary LLM (Claude/GPT/Gemini) as today.
2. Run LocalLLMProvider (once LLaVA-Med is implemented — see Add local LLaVA-Med vision model provider #18) on the same images with the same prompt.
3. In a ConsensusStep, compare the two AnalysisResult structures: flag structures where status differs and confidence delta is large.
4. Surface disagreements in the report as "AI consensus note: local and cloud models disagree on [structure] — recommend radiologist review."

Concerns

• This requires a capable local vision model. LLaVA-Med is the stated target but it is marked "coming soon" (Add local LLaVA-Med vision model provider #18). Until that ships, this step has no local model to compare against.
• The comparison logic needs to be forgiving about phrasing differences ("partial tear" vs "grade 2 partial thickness tear") — naive string matching will produce false disagreements. An LLM-based comparison call is the robust approach, at the cost of an additional API call.
• Performance: Running two full vision analyses per study roughly doubles latency and cost for the cloud call. Consider making this an opt-in flag (--consensus) rather than a default step.

Worth building, but gates on #18 (LLaVA-Med implementation). Would sequence: #57 (de-ID) → #18 (local model) → this.