Complete the v0.4.1 release-integrity milestone

[jamditis]

Before submitting

These are required. If you're skipping any, say why in this section.

• I searched existing issues and pull requests (including closed ones) so this isn't a duplicate
• I tested this change locally

Skipping any of the above? Explain why here:

None.

Description

Complete the remaining v0.4.1 release-integrity work and prepare AudioBud v0.4.2. This makes the Windows distribution self-contained and gives installed NSIS packages an AudioBud-owned, signed update path.

The app now bundles its fonts, downloads speech models from a digest-pinned AudioBud release, exposes raw transcript formatting in advanced settings, and limits automatic updates to verified installed NSIS packages. The release workflow creates signed updater artifacts, a staged update feed, an SPDX SBOM, checksums, attestations, a fixed-WebView2 portable installer, and clean-Windows install and upgrade verification. CI also enforces locked inputs, reproducibility controls, and warning-free real-engine Clippy checks.

The inherited distribution path depended on external Handy assets and did not have an AudioBud updater identity, package-aware update gating, release SBOM, or end-to-end updater verification. The new workflows and runbook establish those ownership and trust boundaries, including an explicit reviewed bridge for planned updater-key rotations.

Related issues

Fixes #39
Fixes #78
Fixes #115
Fixes #154
Fixes #155
Fixes #157
Fixes #158
Fixes #180
Fixes #196

Advances #159, #139, #140, and #141. The updater end-to-end issue and milestone epics remain open until the signed v0.4.2 release exists and a later release proves the installed v0.4.2 to next-version update path.

Testing

• bun test: 285 tests and 1,364 expectations passed
• bun run lint
• bun run format:check
• bunx tsc --noEmit
• bun run build
• actionlint -color=false .github/workflows/*.yml
• updater-key transition validator in normal matching-key mode
• detached mock-engine Rust cargo check --lib --tests
• CI run 30683657542 against commit 72b4062: frontend, secret scan, Linux Rust, and Windows Rust passed
• Real-engine run 30683657553 against commit 72b4062: real-engine Rust tests and warning-as-error Clippy passed
• CI run 30684264090 against final commit 313debc: frontend, secret scan, Linux Rust, and Windows Rust passed
• Required local Codex 5.5 and 5.6 reviews found no actionable regressions; both reviewers also approved the final documentation-only delta

Screenshots / videos (optional)

Not included. The only new control uses the existing advanced-settings toggle pattern; the rest of the change is release, packaging, and trust infrastructure.