Fix Wayland installation and onboarding readiness

[sergiopesch]

Summary

Fresh .45 Wayland installs could pass the voice test while every normal dictation attempt failed because the input helpers were missing. Install the local package and Wayland helpers through APT, start the packaged login service when device access already exists, and check desktop input before onboarding can finish.

 finish successful voice test
- save onboarding complete
+ verify desktop input prerequisites
+ save completion, or show setup instructions and retry

Distinguish setup failures from missing cursors, reject unreachable legacy daemons, add a bounded --check-desktop-input command, and update installation/removal, troubleshooting, architecture and the local guide. Source becomes unpublished candidate .46; the README remains pinned to the published .45 command with its setup caveat. Device permissions and existing administrator services are preserved.

Evidence

• Before: installer regression failed; onboarding persisted completion with a missing helper; the setup-guide URL was rejected by the native allowlist.
  After: targeted regressions pass, including helper installation, daemon failures, timeouts, retry, cursor classification and the exact guide URL.

• Final complete package in an isolated Ubuntu 24.04 GNOME Wayland KVM guest: installer exits 2 without device access; after the fixture owner grants access, rerun starts the service and exits 0. Real onboarding, setup-guide launch, two Alt+D dictations delivering eight expected words, and cursor/daemon rejection all pass. Removal lifecycle also verified.

• 442 frontend, 408 Rust unit/integration, and 17 onboarding renderer cases pass; native capture (42), microphone (31), dictation (71), Chromium exact-field, worker, guide (9), package, build and static checks pass. Two frontend tests are skipped and one Rust test is ignored. Full identities and limitations: verification record.

• Candidate download transport was substituted; virtual audio and owner-granted guest device access were used. This does not verify physical microphones, automatic permission setup, public release downloads or every Linux desktop. No release is published by this PR.

• All four hosted CI gates passed on 13074f3cf4a9a9be7bfe2221d52bec525618a4c2, including Rust speech accuracy/continuity/adversarial regressions, frontend/native desktop checks, the guide and RustSec audit.

Merge Danger

Door: two-way; no configuration schema migration or automatic privilege grant.

Blast Radius: Ubuntu/Debian guided installation, packaged login service, desktop input diagnostics and onboarding completion. Existing users with a broken helper now see setup failure rather than false readiness. Fresh accounts may still need owner-approved device access and a compositor shortcut. Other native package dependency mappings include the process-query tool but are not requalified here.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-20T21:07:45.158713Z	13074f3	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 13074f3cf4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Invoke the installed VOCO binary for readiness checks

When a user has an older source or local installation earlier in PATH (commonly /usr/local/bin/voco before /usr/bin/voco), this executes that binary instead of the package just verified above. An older binary may reject --check-desktop-input, causing an otherwise successful package upgrade to exit with incomplete-setup status, or may report readiness using obsolete logic. Resolve and invoke the packaged /usr/bin/voco explicitly.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Validate the README against the actual published tag

This regex accepts every syntactically valid release tag, so when .46 is eventually published, npm run rehearse:release will still pass if the README continues installing .45 (or any older version). That removes the release gate that previously caught a stale public installation command; compare against an explicitly recorded or independently verified public version instead of accepting any version-shaped string.

AGENTS.md reference: AGENTS.md:L123-L130

Useful? React with 👍 / 👎.