Offer advisory field-classification suggestions with mandatory human review

Tracked by #590. Depends on #592 and should integrate with the review workflow in #596.

## Outcome

Registry authoring tools can propose field concepts and classifications from bounded local metadata and synthetic fixtures, while keeping every proposal separate from reviewed Manifest metadata and active policy until a human explicitly accepts a generated patch.

## Security and privacy rules

- Suggestions never grant access, activate policy, establish legal basis, infer consent, or decide eligibility.
- No raw production records, credentials, secrets, or environment contents are uploaded to a hosted service.
- Source inspection is local, bounded, explicit, and limited to the artifact classes selected by the operator.
- A suggestion remains a proposal even when confidence is high or a prior reviewer accepted a similar field.
- Missing classification is never silently converted into `public` or another permissive default.

## Requirements

- Define a versioned proposal artifact containing the target field address, proposed concept or classification, immutable term IRI, basis, confidence or certainty class, tool/rule/model version, input artifact digests, and limitations.
- Support deterministic suggestions from field names, declared types, selected semantic profiles, schemas, and synthetic fixtures before considering model-assisted suggestions.
- Keep proposal generation separate from Manifest mutation. Acceptance produces an explicit reviewable patch.
- Require selected vocabulary/profile packages from #591 and classification facets from #592.
- Detect new or changed fields and quarantine them as unreviewed rather than inheriting an older field's classification by name similarity.
- Make rejection and correction useful feedback without turning prior decisions into automatic policy authority.
- Redact diagnostics and reports according to the existing project-authoring knowledge classification.
- Record whether a proposal was accepted, modified, or rejected without storing inspected source values.

## Acceptance criteria

- [ ] A local synthetic workspace produces deterministic concept and classification proposals.
- [ ] No proposal appears in compiled Manifest or Relay policy until an explicit patch is accepted and revalidated.
- [ ] New fields remain visibly unclassified or unreviewed when no accepted binding exists.
- [ ] Proposal output includes basis, version, digest, uncertainty, and limitations.
- [ ] Tests prove raw fixture values, secrets, credentials, and environment contents cannot enter proposal output.
- [ ] The documented workflow covers accept, modify, reject, rerun, and stale-proposal behavior.
- [ ] Model-assisted operation, if added, is optional and cannot bypass the same artifact and review contract.

## Non-goals

- Continuous scanning of production registries
- Hosted upload of person-level data
- Automatic policy activation
- Learning legal authority from prior approvals
- Inferring that an unknown field is safe because it has not been classified

Start by reading the linked issues #590, #592, #596, and #591, then trace the review workflow and selected vocabulary/profile packages they define. Done means deterministic local proposals remain separate from Manifest and policy until an explicit validated patch is accepted, with rejection, correction, stale-proposal, redaction, and privacy tests covered.

Written by the indexing model from the issue text.