test: prove the prompt diet end to end with live calls

- streamingCitationRecovery: mocked-adapter integration test that a
  truncated CITATIONS block still yields recovered citations in the
  final SSE event and never leaks into visible text.
- prompt-live-harness: six new adversarial scenarios (no page markers,
  multi-doc attribution, mixed pdf+spreadsheet, fabrication trap,
  page-break quoting, prompt injection). 57/60 across three OpenAI
  tiers; injection and multi-doc 6/6 each. Old-arm scaffolding removed
  now the pre/post-trim comparison is archived in benchmarks.
- prompt-cache-check: provider counters prove the conditional
  spreadsheet splice reuses the identical 2,304 cached prefix tokens.
- liveToolLoop: real-model E2E through the account-free /chat route;
  the model reads an uploaded lease via library tools and routes a
  drafting-errors request to library_lint_docx_structure, relaying its
  verified findings. Gated behind LIVE_E2E=1.
- citations: extract shared extractJsonObjects so the truncation
  scanner exists once, used by both the server and the harness.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QUsMXzBsEJ27DjJVPSfW5o