Sprint 16C — v2.1.0 Release Hardening

[maruson08]

What changed

The v2.1.0 candidate lacked real Korean and combined-language runtime smoke coverage, and its architecture documentation still described OCR as internal after the Image → Text UI shipped. This PR adds deterministic English/Korean fixture coverage for kor and eng+kor, locks OCR runtime loading to the Image → Text route, corrects the release documentation, and records the complete Sprint 16C release-hardening evidence and unpublished v2.1.0 release-note draft.

No product behavior, dependency, CSP, lockfile, or prepared OCR asset changed.

Release result

GO. No BLOCKER or HIGH issue remains. The candidate is ready for a separate v2.1 → main release-promotion task after this PR is reviewed and merged.

The documented remaining limitation is device-dependent large-image latency: a 3000 × 2000 fixture completed correctly in the constrained Chromium QA profile but took about 14 minutes. Cancellation remains available, and no arbitrary input limit was added.

Validation

• npm ci --ignore-scripts — 0 vulnerabilities
• npm run prepare:ocr — regenerated assets produced no tracked asset diff
• npm run build
• npm test
• node tests/ocr-smoke.test.mjs — English, Korean, and combined OCR passed
• Chromium production-page and browser-smoke QA under the production CSP
• Six locales, three themes, 375 × 812 and tablet responsive checks
• Cached disconnected OCR check with the local server stopped
• Representative PDF, Image, and metadata route QA
• git diff --check
• absolute Windows path scan

Tracks #79.

This PR targets v2.1. It does not promote to main, publish a tag or release, or enable auto-merge.