Certify personal capture audio pipeline

[Pepstee]

What changed

• reorganizes the repository around explicit CLI, reusable ML engines, web, and Personal Capture application boundaries
• hardens long-audio ingestion with resumable transcription, diarization and translation stages
• adds offline model pinning and whole-file hash manifests, host preflight, private review flow, and transactional GIGA outbox handling
• aligns deployment assets, documentation, schemas, and tests with the production folder layout
• includes the forensic archaeology reports and remediation evidence while excluding generated audit scratch environments

Why

The first real full-day recording must enter a clean, testable, fail-closed environment rather than exposing unresolved architecture, path, provenance, security, or recovery decisions during production use.

Validation

• 802 tests passed, 2 skipped
• Python compileall passed
• Ruff passed
• wheel and source distribution builds passed
• clean-wheel console entrypoint checks passed
• staged diff whitespace check passed

Host certification remains a separate deployment gate: the exact commit will be fetched on the Gigabyte, the pinned local models will be manifested and loaded offline, and dubbing-capture-preflight --prepare --load-models must report ready before real audio is admitted.