fix: reliability batch 2B — language guard recalibration (effective language, honest bypass, span-aware technical)

[GalaxyRuler]

Before Submitting This PR

• I have searched existing issues and PRs to ensure this isn't a duplicate
• I have read CONTRIBUTING.md

Top of the stack: #78 → #79 → #80 → #81 → #82 → this. Merge bottom-up. Final batch of the reliability effort.

Human Written Description

This is the last piece of the language-correctness work: making the paste-time language guard trustworthy. It had three problems that all pushed the same direction — it judged output against the raw language you'd locked rather than the one the model could actually honor. So locking a language your model doesn't support would divert a perfectly correct transcription to the clipboard, translation that never happened could still wave text through, and a single URL in a sentence could make the whole thing skip the check. This fixes all three and consumes the structured language outcome the earlier batches built.

What's in the batch

1. Guard checks the effective language, not the raw lock. When a model can't honor the locked language and it's downgraded to auto (Support::Unsupported), the guard no longer blocks the resulting correct output.
2. Bypass requires translation actually performed (translation_performed == true), not merely that the model supports translation or it was requested.
3. Technical tokens are excluded from the script census instead of exempting the whole transcript — a long wrong-script body containing one URL is still caught.
4. One bounded, cancellation-aware detected-language retry (confidence ≥ 0.85, detected language in the supported set, first request was auto). Honest limitation, stated plainly: current local engines expose no detection metadata, so this path is inert for them today and the existing conservative clipboard-block remains the only live local recovery.
5. Model switches preserve the user's shortlist, filtering to the supported subset instead of resetting it to a hardcoded default.

Testing

• Full Rust suite: 802 passed, 0 failed (implementation + independent review run).
• tsc, ESLint, Prettier, translations, settings-lock coverage, cargo-deny: pass. No new deps/lockfile/user-facing strings.
• Item 1 regression test mutation-verified independently: injecting the raw-lock behavior makes unsupported_locked_language_falls_back_to_auto_without_guard_block fail; restoring passes.
• Device-verified on real hardware (WhiteKnight), both directions:
  • Lock ar on canary-180m (supports en/de/es/fr only) + real English audio → guard does not block; English transcription flows (the fixed behavior).
  • Positive control: lock ar on whisper-small (does support ar) + real English audio → guard does block. The guard still protects when the lock is genuinely supported.

AI Assistance

• AI was used (please describe below)

If AI was used:

• Tools used: Codex (implementation), Claude Code (audit, code review, mutation verification, WhiteKnight device verification)
• How extensively: implemented and reviewed AI-driven from a human-approved plan with FINAL design decisions fixed in advance; item 1 mutation-tested and the guard behavior device-verified in both directions before push

🤖 Generated with Claude Code