feat(voice): add unprivileged OpenWhispr trial

[CollieIsCute]

Purpose

Install OpenWhispr v1.9.2 beside VoxType for a reversible Linux/macOS A/B test.

Changes

• Pin official Linux, Apple Silicon, and Intel macOS archives with SHA-256 and size checks.
• Load the OpenWhispr-managed Hyprland Lua bind file without granting raw input access.
• Add wtype and wl-clipboard on Ubuntu to match the existing Arch native paste path.
• Verify in CI that Linux does not add the input group, an OpenWhispr udev rule, or ydotoold.
• Keep VoxType and both existing CrispASR models unchanged as the rollback path.

Security boundary

This uses user-local archives, not the deb/rpm post-install hook. It does not add input-group membership, install ydotoold, or create a service.

Verification

• Confirmed release digests against the GitHub v1.9.2 asset metadata and downloaded archives.
• Ran targeted chezmoi apply and verify in an isolated HOME.
• Started the Linux wrapper in the live Hyprland session without --no-sandbox; it generated a native Lua bind and did not create privileged system state.
• First launch downloads an upstream 88 MiB semantic-search embedding cache; this is not an ASR model and is not tracked by chezmoi.
• GitHub Actions covers Arch, Ubuntu, macOS, and Windows.