fix(pdf): bind source locators to one snapshot

[McanKul]

Summary

• Read the classifier source once through the existing 400 MB hard cap.
• Hash and parse the exact same in-memory bytes, removing the path reread race.
• Replace the 64-bit FNV locator identity with a full SHA-256 fingerprint and a strict v2 locator format.
• Resolve a locator against the same parsed snapshot instead of reopening the source.

This remains a read-only research path. It adds no Tauri command, UI, mutation, save, or release change.

Refs #33

Validation

• npm run build
• cargo check --manifest-path src-tauri/Cargo.toml
• cargo test --manifest-path src-tauri/Cargo.toml --lib source_content -- --nocapture (36 passed)
• git diff --check

Privacy checklist

• Files remain local and are never uploaded.
• The source file is not modified.
• Malformed and legacy locators fail closed as STALE.