feat(export): add manual Mermaid handoff bundle

[tuzuminami]

Summary

• add a deterministic, versioned ZIP handoff for manual Mermaid Markdown generation
• keep the product local-only: no LLM client, cloud call, telemetry, or automatic transfer
• validate aggregate-only contents and fail closed on raw URL/title/alias/metadata/review-note collisions
• support Finder save in the packaged app and browser download only in approved development mode
• document the bundle contract, Mermaid guidance, and manual privacy checkpoint

Privacy and compatibility

• raw event rows, IDs, URLs, titles, aliases, metadata, and review notes are excluded
• CSV, generic JSON, and ActivityWatch provenance distinguishes safe activity/app fallbacks from raw fields
• malformed non-string activity/app input is rejected during import

Verification

• macOS agent Swift check passed.
  ============================= test session starts ==============================
  platform darwin -- Python 3.11.9, pytest-8.4.2, pluggy-1.6.0
  rootdir: /Users/yasuakisasama/Documents/OpsMineFlow/services/mining-core
  configfile: pyproject.toml
  plugins: anyio-4.14.2
  collected 79 items

services/mining-core/tests/test_importers.py ....... [ 8%]
services/mining-core/tests/test_pipeline.py ...... [ 16%]
services/mining-core/test_api_logic.py ................................. [ 58%]
..... [ 64%]
services/mining-core/test_auth.py ............ [ 79%]
services/mining-core/test_storage_migrations.py ............... [ 98%]
services/mining-core/test_exporter.py . [100%]

============================= 79 passed in 10.71s ==============================

opsmineflow-desktop@0.1.0 test
node --test test/*.test.mjs && tsc --noEmit

✔ English and Japanese dictionaries have matching non-empty keys (1.751584ms)
✔ every translation key used by the WebUI exists (0.334292ms)
✔ language selection defaults from the browser and persists locally (0.130417ms)
✔ beginner workflow labels are explicit in both languages (0.219709ms)
✔ the packaged WebUI uses the allowlisted Tauri proxy instead of a direct local API session (0.127625ms)
✔ large event lists use bounded pages and offer a user-triggered next page (0.082542ms)
✔ recording polling stays lightweight and dashboard refreshes are single-flight (0.094667ms)
ℹ tests 7
ℹ suites 0
ℹ pass 7
ℹ fail 0
ℹ cancelled 0
ℹ skipped 0
ℹ todo 0
ℹ duration_ms 90.02275

opsmineflow-desktop@0.1.0 build
tsc && vite build

vite v7.3.5 building client environment for production...
transforming...
✓ 35 modules transformed.
rendering chunks...
computing gzip size...
dist/index.html 0.40 kB │ gzip: 0.27 kB
dist/assets/index-C1YULT5_.css 24.91 kB │ gzip: 4.97 kB
dist/assets/index-DYQKULOs.js 299.10 kB │ gzip: 88.41 kB
✓ built in 420ms
Local smoke checks passed.
==> Stopping OpsMineFlow WebUI on 127.0.0.1:62696
==> Stopping OpsMineFlow local API on 127.0.0.1:62695
==> OpsMineFlow stopped
Lifecycle smoke checks passed. (79 Python, 7 WebUI, production build, smoke, lifecycle)

• Compiling Python files...
  Checking SQLite migration registry...
  Migration registry is valid through schema version 2.
  Checking shell syntax...

opsmineflow-desktop@0.1.0 lint
tsc --noEmit

Lint checks passed.

• Checking license policy guardrails...
  License policy check passed.
• Checking local-only network policy...
  Local-only network policy check passed.

Closes #82