feat: preserve result compatibility with Nemotron workflows

[binaryaaron]

Related Issue

No linked issue required: maintainer-owned Phase 10 SDK compatibility work.

Plan Document

Operator-approved P10 plan evidence is retained outside the repository as
anonymizer-p10-sdk-phase9-result-compatibility-plan.md with SHA-256
5436d2815445fd0fa6a71dd98f2861713c209078edb1949e479337afd4346ed7.

This PR is stacked on #260. Review only the delta from
codex/anonymizer-grouped-rewrite-p9.

Summary

• Move legacy public result assembly behind a private compatibility materializer while preserving Phase 9 result types, pandas behavior, metadata identity, failure ordering, telemetry, CLI output, and pickle compatibility.
• Replace retired hosted defaults with Nemotron Super and keep the raw GLiNER request contract behind the explicit gliner-pii-detector alias.
• Accept schema-valid fenced or bare structured JSON from Nemotron through a package-owned DataDesigner plugin.
• Preserve untouched seed columns across DataDesigner and keep replacement diagnostics out of incompatible Parquet checkpoints.
• Update public guidance and the bundled Anonymizer skill for the new default model routing.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Refactoring
• CI, release, or contributor workflow update

Compatibility and Risk

• Public exports and result constructors are unchanged.
• The embedded compatibility contract digest remains c91a410289c3549f608cc0b088da3ce9db56ac10aeabe430a8254b637ef4b12d.
• Frozen P9 pickles load as the expected public types.
• Provider detection recall is stochastic; successful dogfood calls detected between one and four intended entities. This PR establishes execution compatibility, not perfect detector recall.
• No self-hosted GLiNER or cross-repository NeMo Platform execution was performed.

Contributor Checklist

• PR title follows Conventional Commits, for example fix: handle empty entity list
• Related issue is linked, or a maintainer-owned no-issue reason is documented above
• For non-trivial changes, a plan document is linked above, or the no-plan reason is documented above
• Public API impact checked; skills/anonymizer/SKILL.md updated if needed
• No real PII added to tests, docs, notebooks, fixtures, or artifacts
• No API keys, service tokens, private keys, credentials, or real endpoint secrets added

Validation

• Commands run:
  • make test — 4749 passed, 11 skipped, 1 unrelated warning
  • make check — format/lint, typecheck, lock check, and copyright check passed
  • make docs-build — strict build passed
  • uv run pytest tests/engine/test_tolerant_structured.py -q — 5 passed after final formatting
  • clean installed-wheel contract and protocol-4 serialization admission
  • provider-backed run(), preview(), and evaluate() across Redact, Annotate, Hash, Substitute, and Rewrite using synthetic data and Nemotron Super
  • installed anonymizer run CLI against synthetic CSV input
• Skipped checks or known failures:
  • 11 environment-gated Intake integration tests were skipped by the suite
  • make convert-notebooks was not run because it executes all provider-backed tutorials; the changed generated markdown cell was synchronized directly, validated as JSON, and covered by make docs-build

Provider dogfood ran against the pre-commit wheel. The final commit differs from
that wheel only by repository formatting and synchronized notebook prose.

Documentation and Artifacts

• Docs updated, or not needed
• If docs changed: make docs-build passes locally
• If tutorial sources changed: notebooks regenerated with make convert-notebooks
• If e2e, benchmark, or model-provider behavior changed: relevant validation is listed above

External evidence:

• remediation report SHA-256: a71f02385018d9e25ef696402b00d7c8fb3aa8523ddfc2a85316578a60719f37
• remediation manifest SHA-256: e5212cb806c81b483c253d25023ef82fcf6f64031991ebd06c80379be3ab4add

[binaryaaron]

/nvskills-ci