Restore clarification output safety gates

[AndreasInk]

Summary

• treat tester text and screenshots as untrusted model input
• fail closed unless generated output is exactly one question
• require every generated term to come from tester text/history or a small neutral clarification vocabulary
• reject credential/code terminology and all numeric values before model output can reach the sheet or a notification

Why

The clarification simplification merged in PR #2 removed deterministic grounding and sensitive-output checks. This was not a demonstrated exploit—the model is on-device and tool-less—but it was a product-trust regression because arbitrary nonempty model output could reach tester-facing UI and notification text.

Returning nil is lossless: BetaFeedbackKit keeps the tester's original response and simply skips the optional follow-up.

Verification

• swift build
• swift test — 61 tests passed
• focused prompt, delimiter-injection, single-question, sensitive-term, grounding, and private-value regressions passed
• on-device clarification evaluation passed with clarification presence 1.0 and question quality 3.6875 (minimum 3.0)
• independent adversarial review found no remaining high/medium issue in the changed path
• git diff --check

Regression cases

The output gate rejects, among others:

• Which slider disappeared? when neither detail came from the tester
• What happened after you paid for the subscription? when that action was not supplied
• credential, API-key, passcode, and singular/plural verification-code requests
• short and long numeric values such as 123 and 482913, even when present in the input

[AndreasInk]

Closing for now, too much complexity for now