feat: validate native on-device dictation pipeline

[douglasjarquin]

Summary

• Add the smallest Swift macOS 26 AVAudioEngine -> CAF -> SpeechAnalyzer feasibility slice.
• Add volatile/final transcript replacement, raw cleanup fallback, asset/capability inspection, signposts, resource harness, and feasibility record.
• Fail closed for bare command-line hosts without an application bundle identifier after intermittent TCC-dependent signal 133.

Verification

• swift build and dependency-free contract harness pass.
• Real CLI surfaces pass capture/retry, transcript cleanup, twenty-run deterministic memory bound, offline boundary reporting, strict CLI errors, capability inspection, and record validation.
• Final evidence is retained under /Users/douglasjarquin/.codex/evidence/oigo-issue-2/.

Unverified on this host

• 30-minute live recognition/retranscription, live accuracy/latency, complete network-disabled Speech run, native Speech/Foundation Models idle CPU/resource release, and full corpus baseline.
• Reason: Command Line Tools-only macOS host has no stable application bundle identifier; Apple Intelligence is disabled; host networking was not disabled. The feasibility record documents the exact limitation and follow-up.

Closes #2