FU-05 core: caller-supplied Video Bridge transcripts can no longer
self-assert "embedded"/"audio-bridge" provenance — normalizeVideoTranscript
now reclassifies any caller-declared value to "client" by default, and only
a server-owned adapter passing the code-only trustedSource option (never
reachable from request-body JSON) can assign the trusted values. The
dedicated audioTranscript fusion field is always labeled "audio-bridge" by
the server regardless of what a cue declares, structurally separating it
from the generic transcript field.
Adds the missing FU-05 budgets (256 cues, 4096 input code units/cue, 4 KiB
UTF-8/cue, 64 KiB total text), malformed-Unicode rejection, focus-window
scoping, and deterministic cross-source cue reconciliation that preserves
contributing-source metadata instead of silently dropping it on exact-match
dedup. New logic lives in videoBridgeTranscriptContract.ts so the existing
helper file only grows by a thin delegation.
Bumps the Video Bridge result-cache contract version (v4 -> v5) so a cache
entry computed under the old, less-restrictive normalization can never be
served once the new contract is deployed.
3 of the 12 pre-existing provenance tests asserted the exact forged-source
acceptance this ticket closes; updated in place with inline rationale.
