Embedding execution, transaction, and privacy invariants

Check abort immediately before every embedding-provider invocation, including recall bypass and admission handoff; release the exact acquired token on post-grant abort. Track vector-state changes with helper-owned nested transaction frames and shared connection-in-transaction detection: nested commits merge upward, only the outer commit publishes, and rollback discards its frame. At every remote, worker, or custom-provider boundary, replace raw failures with a fixed cause-free EmbeddingProviderError. Reconstruct only allowlisted control errors, guard hostile Proxy and instanceof inspection, keep properties non-enumerable, and never expose provider bodies, statusText, diagnostics, or causes.