VoiceFlow 0.3.1 interaction and release polish

[qinxujunai]

What changed

• removes the fixed hotkey debounce and serializes real press/release intents, so fast F2 taps stay responsive without held-key repeats
• keeps zero-audio cancellation neutral and preserves the established capsule colors and 已完成 / 已复制 / 已保存 contract
• redesigns settings around status, dictation, dictionary, and history tasks; history copy/re-paste now uses verified delivery results
• aligns the website, product demo, architecture docs, version metadata, installer, SBOM, checksums, and release notes with the shipped 0.3.1 behavior
• makes signing conditional while requiring an explicit unsigned disclosure when no certificate is configured

Verified locally

• scripts/verify.py: 340 tests, 500/500 lifecycle cycles, model benchmark, integration
• packaged runtime smoke: pass
• installer smoke: pass, including private-vocabulary, install/start/uninstall, and retained user data checks
• UI quality: pass at 100%, 125%, 150%, and 200% scaling
• flagship stress: 10,000 state transitions, one-hour recovery coverage, 5,000 delivery faults, 50,000 safe-text fuzz cases
• local sample installed and running as 0.3.1+260811.2

Public release gate

No v0.3.1 tag or public asset is created by this PR. scripts/verify.py --release correctly blocks publication because the required 20 real streaming-preview performance samples are absent. The repository checklist also keeps the authorized 160-sample/holdout and clean Win10/11 evidence open. Website deployment therefore remains on the last verified public Release until those gates are closed.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7f8ea81585

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the foreground target for history repaste

When a user clicks this new per-card “再次粘贴” button, the settings window and its button are the foreground target. The callback reaches OutputHandler.output(), which captures that VoiceFlow-owned non-input window and therefore correctly classifies it as own_process, so the operation only updates the clipboard and never pastes into the application the user came from. Preserve the previous ordinary foreground target or hide/deactivate settings before dispatching the requested paste.

AGENTS.md reference: AGENTS.md:L57-L62

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Render the signing claim from the actual release mode

When the certificate secrets are configured, this conditional signs the application and installer, but the same workflow still publishes release notes and deploys site copy that unconditionally say the installer is not code-signed. Thus a successful signed release is accompanied by a false security limitation; either derive the public claim from SIGNING_AVAILABLE/the asset signature or make the release mode match the static copy.

AGENTS.md reference: AGENTS.md:L161-L162

Useful? React with 👍 / 👎.