Add OCR review pipeline and dual-edition builds

[cwyalpha]

What changed

• add fixed-hash four-way page orientation and expose OCR pipeline controls
• add PDF/image review UI with OCR boxes, confidence highlighting, paging, editing, and rerun
• add immutable OCR/full editions and a four-platform, eight-asset build matrix
• add generated fixture gates, searchable-PDF regression tests, and recursive sensitive-data release auditing

Why

This improves rotated and scanned PDF accuracy while supporting lightweight OCR-only packages alongside full Office-conversion builds.

Validation

• 30 pytest tests passed
• real PP-OCRv6 tests passed for 0/90/180/270 degree inputs and an uncopyable scanned PDF converted to searchable PDF
• macOS arm64 OCR/full frozen-package smoke tests passed
• Kylin V10 ARM64 OCR/full clean-container CLI tests passed, including bundled LibreOffice 6.0.6.1
• source and all four locally buildable assets passed recursive sensitive-data audit

Remaining release gates

• build Windows x86_64 OCR/full packages
• build Kylin V10 x86_64 OCR/full packages
• grant the new macOS bundles Screen Recording permission and run the final real selection/OCR regression
• generate the unified eight-asset SHA256SUMS.txt and publish the Release