Complete BL-017 review signal ownership audit for OCR grouping and rounds

[xeonvs]

Goal

Complete the bounded BL-017 source-to-signal audit after OCR 1.10.0 adds semantic grouping and multiple review rounds.

Parent: #135. Draft implementation: #134.

Acceptance

• Map group, round, request, token, latency, tool, result, receipt, DLP, posting, and approval signals to their authoritative owners.
• Document privacy/cardinality effects of upstream group labels and file paths when OCR telemetry is explicitly enabled.
• Keep OCR authoritative for provider/review telemetry and toolkit receipt/log projections authoritative only for deterministic lifecycle/publication signals.
• Conclude no-new-layer unless evidence proves a separately scoped provider-neutral gap.
• Keep BL-016 parked, BL-018 conditional, and BL-019/BL-020 inactive.

Result

The source-to-signal matrix is committed in docs/engineering/review_signal_ownership.md. OCR 1.10.0 constructs group span names and attributes from path-derived group keys and model-produced labels, so enabled upstream telemetry is repository-derived and potentially high-cardinality. Toolkit 0.8.2 does not ingest these fields into receipt v5, DLP telemetry, posting, approval, severity, fingerprints, or routing and adds no exporter or second telemetry layer.

Rebased implementation commit: c3db5b9. Release delivery remains tracked in #135 and Draft PR #134.

[github-actions]

Stable v0.8.2 delivery is verified by immutable release asset release-receipt.json in v0.8.2 (SHA-256 0ac489fa17ce376895ae591b8531358f41682df76a86c36f2bf2dbb2e71ca2b3).