Persist failed inference inputs at the application boundary

When exact failed inputs are needed for diagnosis, let the application boundary that owns identity, authorization, and lifecycle persist bounded samples in private object storage; do not make a stateless inference host the durable record. Reserve an owner record before upload, use deterministic request-scoped paths and hashes, and keep capture failure non-fatal. Sampling rate, retention, access, deletion, consent, cost, and orphan reconciliation require explicit approval.