docs(video): clarify Video Bridge transcript provenance is caller-declared (#11661)

The transcript source field (client/embedded/audio-bridge) is validated against an
enum but is not yet server-verified — OmniRoute does not confirm that an
embedded/audio-bridge label actually came from a server-owned extraction. GUARDRAILS.md
previously documented the enum without flagging this gap, which is exactly what issue
#11652 exists to close. This is a documentation correction only; no runtime behavior
changes.

Refs #11661

changelog.d/maintenance/11661-video-bridge-transcript-provenance-doc.md

@@ -0,0 +1,5 @@
+- **docs(video):** clarify that the Video Bridge transcript `source` field (`client`,
+  `embedded`, `audio-bridge`) is presently caller-declared and not yet server-verified —
+  OmniRoute enforces the enum shape but does not cryptographically confirm that an
+  `embedded`/`audio-bridge` label came from a server-owned extraction
+  ([#11661](https://github.com/diegosouzapw/OmniRoute/issues/11661)).

docs/security/GUARDRAILS.md

@@ -1,13 +1,14 @@
 ---
 title: "Guardrails"
-version: 3.8.50
-lastUpdated: 2026-08-24
+version: 3.8.51
+lastUpdated: 2026-08-29
 ---
 
 # Guardrails
 
 > **Source of truth:** `src/lib/guardrails/`
-> **Last updated:** 2026-08-24 — v3.8.50 (Video Bridge visual dedup hardening + focused captions)
+> **Last updated:** 2026-08-29 — v3.8.51 (Video Bridge transcript provenance is caller-declared,
+> not yet server-verified — clarified per #11661)
 
 Guardrails enforce safety, policy, and content transformations at the boundary
 between OmniRoute and upstream providers. Each guardrail can inspect (and
@@ -437,7 +438,12 @@ OmniRoute never starts transcription from this metadata: validated cues are
 copied into the described result with source, confidence, and interval, and
 are rendered as untrusted observations alongside the frame captions. Invalid,
 out-of-range, or provenance-free text is rejected rather than mixed into the
-caption stream.
+caption stream. The `source` field is presently caller-declared, not
+server-verified: OmniRoute enforces that the value is one of the three
+allowed strings, but does not yet cryptographically confirm that an
+`embedded` or `audio-bridge` label actually came from a server-owned
+extraction. Treat `source` as an untrusted hint until that verification
+lands; do not build authorization decisions on it.
 
 An advanced caller may provide an already-authorized `audioTranscript` track
 for the same video. The fusion seam runs visual and audio observations under