feat: add on-device transcription and saved-audio retry

[douglasjarquin]

Closes #5

Summary

• Add the on-device TranscriptionService Speech framework architecture with exact locale and speech-asset readiness handling.
• Feed live audio into the analyzer while preserving durable CAF capture and descriptor custody.
• Separate volatile previews from finalized transcript segments and preserve canonical raw.txt through atomic persistence and retry staging.
• Serialize terminal operations, handle startup-final races, cancellation, failure, interruption, saved-audio retry, overlap merging, and bounded finalized state.
• Preserve issue [03/13 · MVP] Add durable microphone capture and crash-recoverable sessions #4 lifecycle, path-safety, resource, and descriptor contracts.

Verification

• Exact head: 9bee9b2bf6582e31ee4cfd4d4861532c10ca40b0.
• Base: main at 490121e0954626109d070ebdb7e73ebc9604aceb.
• swift build --scratch-path build-final-9bee9b2 passed.
• Full issue [02/13 · MVP] Build the native menu-bar shell and dictation state machine #3, issue [03/13 · MVP] Add durable microphone capture and crash-recoverable sessions #4, issue [04/13 · MVP] Add on-device transcription and saved-audio retry #5, and spike contract matrix passed.
• The issue [04/13 · MVP] Add on-device transcription and saved-audio retry #5 early-final service-publication regression and the prior code-review fixes passed focused verification.
• The repeated exact-SHA audit passed 11 lanes for 20 iterations each.
• Evidence is retained under /Users/douglasjarquin/.codex/evidence/oigo-issue-5/.

Review custody and host limitations

• Fresh exact-SHA goal, code, security, QA, and context reviewers were given two bounded wait windows and all stalled on the host without terminal receipts.
• Those five lanes are recorded as INCONCLUSIVE, not approval, in review/9bee9b2-review-terminal.md.
• The command-line-tools host cannot prove bundled Speech/TCC live recognition, native 30-minute capture, native model memory return, or externally disabled-network behavior.
• No cloud fallback or network client is present in the Oigo path; disabled-network proof remains unverified.

This PR is intentionally non-draft and remains open for human merge.