Validation: Proactive Source-Inbox Security Pipeline

Validation targets:

Security alerts can be marked proactive automatically, forced per task, or kept passive.
Normal candidate classification remains unchanged.
The proactive queue uses atomic claim state separate from the public inbox status.
Materialized items remain searchable as local evidence before SearXNG.
Source-Inbox schema migration adds proactive state without replacing or deleting existing rows.
Model extraction is source-only and requires concrete facts plus minimum confidence before graph materialization.
Direct page fetch is preferred; SearXNG is used only when the model requests missing evidence.
Project-wide compile/vet and frontend syntax checks are run in the available offline toolchain validation copy; the release source keeps its Go 1.26 / modernc SQLite dependency unchanged.