Hybrid Tauri/Python desktop architecture

[MyButtermilk]

Summary

This draft PR implements the Scriber hybrid desktop architecture from docs/Hybrid-Architecture-Goal.md:

• Adds the Tauri 2 desktop shell, Rust backend supervisor, sidecar backend packaging, session-token protected local API access, single-instance handling, tray/menu lifecycle commands, desktop autostart, Tauri-owned global hotkey dispatch, support bundles, frontend readiness beacon, updater wiring, and Windows release workflow gates.
• Keeps Python as owner for STT/provider logic, Pipecat pipeline, SQLite, summaries, jobs, uploads, exports, ffmpeg/yt-dlp, and the default microphone/audio path.
• Adds app-level Python mic prewarm/reuse, lower-latency live recording measurements, DeviceMonitor/device-refresh hardening, history pagination/virtualization, frontend chunking, debug console, and release/installer smoke coverage.
• Adds release evidence tooling for the remaining external gates: microphone hardware matrix runner/validator, Authenticode report output, updater publication verification, final hybrid release readiness validator, and a top-level readiness runner.

Validation already captured locally

Focused checks run during implementation include:

• Python contract/security/lifecycle/performance focused suites across backend, runtime, DeviceMonitor, mic prewarm, WebSocket/REST contracts, upload/export, release metadata, and release gates.
• Frontend npm run check and npm run build during the implementation cycles documented in docs/Hybrid-Architecture-Validation.md.
• Tauri/installer smoke gates for frontend assets/WebView readiness, cleanup, uninstall, support-bundle redaction, crash recovery, controlled shutdown, startup timeout, default-port conflict, external-backend attach, global hotkey registration, and short live-recording stability.
• Latest focused additions:
  • tests/test_hybrid_release_readiness_runner.py
  • tests/test_validate_hybrid_release_readiness.py
  • tests/test_verify_tauri_updater_publication.py
  • tests/test_windows_authenticode_gate.py
  • tests/test_validate_microphone_hardware_matrix.py
  • tests/test_microphone_hardware_matrix_runner.py

Remaining external gates before ready for merge/release

This stays draft because the following cannot be proven from the repo alone:

• Physical microphone matrix artifacts for USB add/remove, Bluetooth add/remove, dock connect/disconnect, Windows default input change, and favorite-mic fallback.
• Real Authenticode signing with the expected publisher and optional timestamp evidence.
• A real signed Tauri updater release with published latest.json verified after GitHub release publication.
• Optional stricter long live-recording soak if required beyond the accepted 5-minute gate.

Use scripts/run_hybrid_release_readiness.ps1 after those external artifacts exist to produce the final hybrid-release-readiness.json verdict.