WhisperKit: harden TextDecoder against nil logits and prefill drift

[yemreak]

Summary

Two related fixes in TextDecoder:

1. Replace force-unwraps that crash on degraded CoreML output (three decoderOutput.logits! and one decoderInputs.initialPrompt.last!) with guard let that throws WhisperError.decodingFailed. The crashes are easy to hit (model swap mid-flight, OOM, malformed model) and impossible to recover from at the call site.

2. Fix early-termination during prefill when a non-empty promptTokens is supplied. The previous logic considered the first decoded token to be at prefilledIndex, but with a prompt it really starts at max(prefilledIndex, initialPromptIndex). Without this, the decoder can early-stop mid-prompt and produce empty or truncated transcripts for any caller that uses promptTokens to steer Whisper (e.g., feeding a glossary or a prior-context window).

Changes

• guard let + WhisperError.decodingFailed(...) for the four force-unwraps.
• Add an isInPrefillPhase flag and:
  • gate isFirstTokenLogProbTooLow so it only fires after the prompt has been consumed and only when no promptTokens were supplied;
  • skip the sampleResult.completed segment-completion check during prefill (the model is being force-fed prompt tokens and may legitimately predict EOT mid-prompt).

No new public API; behaviour with empty promptTokens is unchanged.

Testing

• Reproduced the mid-prompt early-stop on large-v3 with a non-trivial promptTokens and confirmed it disappears with the patch.
• Force-fed a malformed model to verify the new throws path surfaces a clean error instead of EXC_BAD_INSTRUCTION.
• Existing WhisperKit test suite passes locally.