refactor: split Linux egui host from shared backend

[H-Chris233]

Summary

• Complete the Core 2.0 consolidation with Core-owned provider/credential/model policy, recording and hotkey state machines, insertion reconciliation, Remote Input framing, Local ASR activation, Coding Agent command materialization, startup handshake, and semantic events.
• Keep Tauri and Linux as platform adapters for native audio/ASR, credentials, process execution, windows/focus/input, TLS/WebSocket, DBus/fcitx5, and UI/event presentation. Replaced Host business implementations are deleted in the same phase.
• Restore 1.x behavior parity across the shared backend while freezing the runtime contract at 2.0.0 and preserving 1.x local-data migrations.
• Deliver an independent Linux egui host and validation packages without Tauri/WebKitGTK.

F01-F24 closure

All F01-F24 source and automated-contract items in docs/linux-egui-shared-backend-plan.md are implemented:

• F01-F06: Linux provider UI and production factory, shared CredentialDirectory, provider descriptors/auth/probes/model listing, keyless custom endpoints, write-only secrets, channel ordering/activation.
• F07-F12: shared recording/silence/fault policy, opaque insertion targets and Core edit observations, correction/attribution, Core hotkey generations, bounded silent ASR retry, Remote Input pre-ACK queue and Core frame codec.
• F13-F18: macOS newline policy, one effective pipeline mode, PasteSent vs OutcomeUnknown, Core-only final reconciliation, capsule/fallback ownership, Unicode replace-from transcript replay.
• F19-F24: legacy custom model-root migration, atomic Local ASR activation, packaged Linux Qwen runtime, Core AgentCommand, fail-closed startup handshake, and same-phase removal of replaced Host policy.

Validation

Final head: 2f961caec5d749ed444a0fa3dc24ef136a58f9a5

Local full implementation validation was run on df39d217; the final Android-only follow-up then passed targeted cargo check, the shared-backend source contract, formatting, and git diff --check before push.

• Frontend: build plus 66 tests passed.
• Core: 701 unit tests passed, 1 ignored; contract suites passed for backend (5), Local ASR (19), Marketplace (17), prompts (3), QA (19), Remote Input (11), Selection (15), and Selection Voice (15).
• Tauri: 413 library tests and the independent backend contract passed; default and Rust 1.88 checks passed.
• Linux: Windows contract run passed 38 library + 4 host tests; WSL passed 44 library + 4 host tests, strict clippy, and the fcitx5 C++ build. Three real-service/device contracts remain explicitly ignored.
• Gates passed: Core/Linux dependency direction, command/event baseline (199/30/30, contract 2.0.0), secret surface, test isolation, runtime seam, Linux public surface, shared-backend source contract, and diff checks.
• No binary diff, no merge commits, and the PR merge-base is the current beta head fc9824ee.

Remote evidence for this exact head:

• Upstream PR CI 33892760207: Windows, macOS, Linux, and Android all passed, including Android target compilation, JVM credential tests, and Keystore instrumentation.
• Fork CI 33892859952: all five jobs passed, including the Linux validation package job.
• Release Tauri 33892864735: macOS arm64/x86_64 and Windows x64 builds passed.
• Android APK 33892869912: arm64-v8a, armeabi-v7a, x86, and x86_64 debug artifacts were uploaded.

Linux artifact audit:

• deb/rpm/AppImage artifact contains the egui executable, fcitx5 plugin/config, Qwen runtime, desktop entry, metainfo, and icons.
• AppImage SHA-256 matches its metadata. ldd on openless, libopenless.so, and qwen_asr reports no missing libraries and no Tauri/WebKitGTK dependency.
• Manual fork validation artifacts are unsigned (minisign=null), as expected; this is build evidence, not release-signing evidence.

Final review

Standards: no blocking findings after dependency, secret, runtime, public-surface, formatting, linear-history, and source-policy checks.

Spec: F01-F24 production wiring and automated contracts are closed. The Android stub regression found by the first CI run was fixed in 2f961cae and the replacement CI passed completely.

Release gates still open

Do not merge or promote to stable based on CI/artifacts alone. Real-device evidence is still required for Ubuntu audio/focus/input/fcitx5/Secret Service and deb/rpm/AppImage install-upgrade-rollback; Windows Foundry/Sherpa/TSF insertion and installer behavior; macOS MLX/Whisper/Apple Speech/focus/newline and signing/notarization; Android overlay/accessibility/Shizuku/IME and APK install-upgrade behavior. These are explicit evidence gaps, not hidden source stubs.