fix(cv): harden document parsing

Upgrade and hash-lock upload-facing parser dependencies, reject resource-heavy or mismatched inputs, remove unsafe backend binary fallbacks, and prevent internal parser failures from leaking to users.

docs/work-programmes/master-work-plan.md

@@ -222,11 +222,11 @@ This queue records the highest-value work that can proceed without production cr
 - **Required tests:** dependency resolution/audit, Python suite, generated benign corpus.
 - **Required browser verification:** none for dependency-only package.
 - **Required production verification:** image digest and smoke before activation.
-- **Status:** `BLOCKED`.
-- **Blocker:** repository instructions prohibit internet/package resolution without explicit permission; fixed-version compatibility cannot be resolved or verified offline.
-- **Evidence:** audit lists reachable Pillow/pypdf/multipart/Starlette advisories and compatibility conflict.
+- **Status:** `IMPLEMENTED — NOT VERIFIED`.
+- **Blocker:** Docker Desktop is installed but its Linux daemon is offline, so the hash-locked production image has not been built locally.
+- **Evidence:** `docs/verification/sec-006-parser-dependencies.md`; upload-facing dependency audit is clear; clean hash install succeeds; parser suite 32/32; backend 719/719.
 - **Commit:** none.
-- **Remaining work:** explicit package-index permission, compatible fixed-version resolution, lock/hash refresh, audit, benign corpus parity and image smoke; do not execute malicious files.
+- **Remaining work:** build the production image from `requirements-linux.lock` and run its health/benign extraction smoke when a Docker daemon is available. Torch/Transformers advisories remain separately tracked under JT-017 and are not accepted as upload-parser findings.
 
 ### SEC-007 — Bounded isolated document processing
 
@@ -240,11 +240,11 @@ This queue records the highest-value work that can proceed without production cr
 - **Required tests:** generated boundary/corrupt fixtures, harmless sleeping child, cancellation/restart cleanup, outage/no-fallback, container assertions.
 - **Required browser verification:** synthetic CV upload status/failure; authorized private CV local-only only after safeguards.
 - **Required production verification:** measured memory/CPU limits and canary synthetic extraction.
-- **Status:** `NOT STARTED`.
-- **Blocker:** follows dependency update; production sizing requires access.
-- **Evidence:** audit parser call path and limits design.
+- **Status:** `IN PROGRESS`.
+- **Blocker:** production sizing requires access; local Docker container assertions require a running daemon.
+- **Evidence:** signature/container validation, page/pixel/decompression/output ceilings and stable parser errors have boundary tests; backend binary fallback is removed and raw unexpected failures are sanitized. Focused backend 51/51, full backend 719/719 and parser 32/32 pass.
 - **Commit:** none.
-- **Remaining work:** split behavioral and container commits if needed.
+- **Remaining work:** move decode into a deadline-bounded child process/process group, add descendant termination and cleanup tests, bound scheduling/backpressure, then apply and verify non-root/read-only/PID/CPU/memory/tmpfs container controls.
 
 ### SEC-008 — Recoverable attachment mutations