fix(analyzer): gate AE3 and AE4 on text content

[rodboev]

Summary

AE3 and AE4 no longer inspect decoded cache text for artifacts classified as binary or opaque. Inventory, ledger accounting, AE1, AE2, AE5, and report ownership remain unchanged.

Root cause

Artifact integrity reused decoded cache content without honoring the authoritative raw-byte content_kind, so an opaque PNG could be treated as text for mixed-script and instruction checks.

Diff Notes

• Added an analyzer-local applicability guard for explicit BINARY and OPAQUE rows.
• Added the exact PNG production regression and text/direct-node negative-space coverage.
• Kept AE1 reference policy and all report/ledger contracts unchanged.

Scope

This PR references #413 because it fixes the AE3/AE4 slice only. It does not change AE1 policy, artifact classification, static-runner routing, scoring, report schemas, or analyzer registration.

Verification

• Focused tests: python -m pytest tests/nodes/test_security_remediation.py tests/nodes/analyzers/test_artifact_integrity_bounds.py passes, including opaque inventory, AE1, AE2, AE3, and AE4 preservation coverage.
• Ruff check, format check, and git diff --check pass.

Refs #413

[rng1995]

[SkillSpector Review]\n\nApproved. Gating AE3/AE4 on textual content removes binary/opaque false positives while retaining archive-integrity checks and text-based mixed-script detection. The misleading-extension regression is especially useful. Current required checks pass.

[mohgupta-ship-it]

Powered by Codex: PR council review result.

This is a triage signal, not a maintainer approval.

• Rating: regression-fix
• Confidence: high
• Status read: Approved, branch behind, green checks
• Review method: fresh GitHub metadata/body/files/reviews/checks plus selected diffs; council lenses were spec fit, dead-code/reachability, YAGNI/scope, design/coupling, and code standards/tests.
• Council assessment: False-positive fix that gates AE3/AE4 on textual content while retaining archive-integrity behavior.
• Recommended action: Update branch, rerun CI, then merge if still green.

[rodboev]

Rebased onto current main and force-pushed as 2382217. The rebased commits retain Signed-off-by trailers, and the new DCO Check is passing. Local focused validation passed: pytest tests/nodes/test_security_remediation.py -q (67 passed), ruff check src/ tests/, and ruff format --check src/ tests/. The remaining hosted checks are running.