fix(cv-import): bound source retention and guard worker recovery

docs/cv-import/SIDECAR.md

@@ -28,6 +28,14 @@ Scans and image-only PDFs fail cleanly with OCR disabled. Encrypted documents, a
 
 The adapter is a qualification seam; the active import path remains deterministic and does not call it. Actual provider/model compatibility, factual relationship validation, EN/Bokmål language quality, adversarial semantics, GPU behavior and model accuracy remain **BLOCKED**. Enabling production inference requires a separately approved immutable artifact and isolated qualification; environment configuration is not acceptance.
 
+The local transport disables environment proxies and rejects redirects, so an operator-configured local address cannot redirect document content to an external service.
+
+## Isolated Linux development image
+
+`Dockerfile.cv-import-dev` layers the current source and separate interpreter over an explicitly inspected existing runtime. It is not referenced by production Compose. Prepare a fresh context containing that Dockerfile, app.py/parser_child.py/cv_import_ai.py, the CV import lock and a `wheels/` directory downloaded with the lock's hashes for Linux/Python 3.12. Tag the inspected base ID locally, pass that tag as `CV_IMPORT_BASE_IMAGE`, and build with `--network none --pull=false`. Verify the tag resolves to the inspected ID before building. No registry publication occurs.
+
+The Linux child caches trusted platform metadata before installing its subprocess/network deny hook, then parses untrusted bytes. HOME/USERPROFILE point only at the private work directory; they never expose the host's model cache. The actual child retains POSIX CPU/address-space limits. `.artifacts/cv-import/real-sidecar-api-03.log` records PDF 200, DOCX 200, scan 422 through FastAPI and the real isolated Docling subprocess. Earlier failed API/build attempts are retained. Base-image/dependency security still inherits the open advisory qualifications; these runtime checks do not close them.
+
 ## Current focused evidence
 
 - `.artifacts/cv-import/sidecar-focused-02.log`: 23 passed, including real native PDF/DOCX conversion and synthetic model-adapter tests; no generative inference.