[leehack]

Adds sd_dart_new_sd_ctx_intrinsic_tiny_v1, an opt-in tracked-context contract for the iOS safety restriction in llamadart #1047. Unrestricted contexts keep their existing behavior.

A load-time SDXS check was insufficient: automatic native model refresh could replace SDXS with SD-Turbo and run a full VAE while Dart still reported SDXS. The new contract validates initial and refreshed model families before runner construction/probes, and rechecks image/video execution under the context lock. External decoder overrides are refused; rejection and free remove policy state.

This is an owner-specific context policy, not a claim that upstream refresh is defective. The carried insertion points have a causal runtime test and a documented retirement condition when an equivalent upstream contract exists.

Validation:

• Independent source and bounded macOS artifact review accepted exact owner head 4a5fec23c99c24089e3b5f88d05f45d65354dc04 and core head a19dd366e03be14dbc00fcb0f52aedfff35fd48e, with zero blocking findings.
• Exact-head macOS rebuild: 12 CPU/Metal reload controls pass, including guarded full-VAE replacement refusal, unrestricted reload, and preserved SDXS refresh. Release/ASan teardown checks pass with documented platform skips.
• Core full suites: 10,400 VM tests passed (127 skipped), 4,467 Chrome tests passed (1 skipped). Production engine/worker tests cover the new policy, missing-capability refusal, and Metal diffusion with CPU VAE.
• Final manifest SHA256: b93dac8702c7b9c848bee6784e689bfa4461b3d127b786bfd0195c91fcbc486d; independent audit receipt SHA256: 97d805640462cd07a430ec40fa47881fee3c05335ddddd634197eb8854298164. No physical-iPhone watchdog qualification is claimed.

Draft only. New-head CI, Linux release/ASan host-shutdown, iOS/platform artifact qualification, publication approval and core pin adoption remain separate gates. No runtime publication or consumer pin change.