Bound local Voice History audio storage

[MarcusJRLee]

CUJ

• Completes macOS M7: independently configurable age, byte, count, and low-disk audio limits.
• Preserves searchable transcripts and immutable results while protecting active, pinned, and recovery audio.

Architecture

• Adds one deterministic platform-neutral retention planner and a dedicated SQLite/file maintenance actor.
• Shares one History service across capture, browsing, preferences, and maintenance.
• Keeps cleanup off capture, target validation, delivery, and hardware hot paths.

Verification

• scripts/check.sh: 451 tests across 69 suites, strict format/clang/shell checks, release build, and release/notarization policy tests.
• 5,000-session warm-search p95: 2.615 ms against 250 ms.
• HID p50/p95/p99/max: 0.016/0.060/0.115/0.846 ms.
• Signed packaged UI verified in light, dark, increased-contrast, reduced-motion, and large-text modes.

Migration and recovery

• Migrates preferences to schema 6 and adds nullable expiration provenance columns without rewriting prior sessions.
• Quarantines audio, commits metadata atomically, restores on transaction failure, and revalidates pin protection in the update.
• M8 retains partial and orphan crash reconciliation.

Stack

• Depends on Add reusable local Voice History #9 because repository-required checks are unavailable; protections are not bypassed.

[MarcusJRLee]

Integrated into dev through rebase-merged rollup PR #34. This intermediate PR remains preserved as the focused review record for its original slice.