feat(detection): domain-aware entity labels via early domain classification

Context

Entity detection currently uses a fixed default label list (55 labels) regardless of the input domain. Domain-specific entities like court_name, case_number, prison_detention_facility (legal) or diagnosis, procedure, medication (medical) are missed in the first detection pass. This causes downstream issues:

• The privacy judge penalizes for entities it doesn't recognize as having been handled
• Latent entity detection has to rediscover entities that should have been caught explicitly
• Sensitivity disposition operates on an incomplete entity set

From e2e testing feedback: adding domain-specific entity labels to legal data improved privacy judge scores (6.65 vs 5.67 with defaults).

Proposal

Move domain classification into the entity detection pipeline, before GLiNER runs:

1. Classify domain (single LLM call, reuse existing DomainClassificationWorkflow)
2. Look up domain-specific labels from a new DOMAIN_ENTITY_LABELS mapping
3. Merge with default labels to form the expanded detection label set
4. Run GLiNER + validation + augmentation with the expanded labels

The domain classification result is stored on the dataframe and reused by the rewrite pipeline's pre-generation step (no duplicate LLM call).

Design considerations

• Domain classification runs on the raw text (no entity tags needed), so it can precede detection
• For replace mode, domain classification is an extra LLM call that wasn't there before. Consider making it opt-in for replace, always-on for rewrite
• When entity_labels is explicitly provided by the user, domain-specific labels should NOT be added (user knows what they want)
• The domain column should be carried through to the rewrite pipeline so the evaluate-repair loop can use it without re-classifying
• Also add broadly useful labels to the default list directly: nationality, court_name, prison_detention_facility

Acceptance criteria

• Domain classification runs as the first step of detection when rewrite mode is enabled
• DOMAIN_ENTITY_LABELS mapping exists with at least legal, medical, and biography domains
• Detection uses merged (default + domain-specific) labels for GLiNER, validation, and augmentation
• Domain column is available to the rewrite pipeline without a second classification call
• entity_labels override still works (skips domain-specific additions)
• Replace mode is unaffected unless opted in

Start with DomainClassificationWorkflow and the existing entity detection pipeline, then trace how GLiNER, validation, augmentation, and the rewrite pipeline exchange dataframe columns. Define the DOMAIN_ENTITY_LABELS mapping and verify the acceptance criteria, especially explicit entity_labels overrides and replace-mode behavior; done means domain classification is reused without a second call and merged labels reach every detection stage.