fix(application): route Claude category capture

[akoita]

Closes #395

Summary

• route the explicit local Claude category capture parent through begin, start, and resume run construction
• consume it only for Anthropic user-session adapters; default, extraction, API-key, and OpenAI paths remain unchanged
• extract provider construction from the frozen local runtime hotspot and lower its limit from 3,780 to 3,688 lines
• add application-boundary privacy and isolation coverage and synchronize architecture/roadmap documentation

Verification

• pnpm validate
• 104 Vitest files / 1,585 tests passed
• 54 release-script tests passed

Two earlier unchanged full-gate attempts reproduced open load-sensitive failures tracked by #385/#389; every exact failing case passed in focused execution, and the final unchanged full gate passed. All provider behavior used injected fakes; no provider call or authentication probe was made.