fix(pipeline): restore None guard for no_retention in content_hash_value — DPDP violation #281

Summary

When doc.no_retention=True, ingest_document calls upsert_document(content_hash_value=hash_value, ...) at line ~511. The guard None if doc.no_retention else hash_value that existed before fix #241 was removed. Content hash is now stored in PostgreSQL even for documents that must leave no trace — DPDP contract violation.

Root cause

Fix #241 rewrote the early-dedup path but dropped the None if doc.no_retention guard on content_hash_value. The inner guard at line 494 only covers the status-downgrade scenario (fallback_only re-ingest), not the hash-persistence scenario for no-retention docs.

Fix

ingestion/pipeline.py line ~511:

# Broken (after #241):
content_hash_value=hash_value,
# Fixed:
content_hash_value=None if doc.no_retention else hash_value,

Impact

Every no-retention upload leaks the content hash to documents.content_hash. A subsequent upload of the same bytes finds the hash row, violating the no-retention privacy contract.