Voice M9: enforce local-only provider boundaries

[MarcusJRLee]

Summary

• require typed provider identity and locality, rejecting remote-capable or mismatched adapters before Voice content transfer
• retain playable audio and truthful not-attempted History when ASR fails after capture
• prove deterministic Edited fallback, zero remote-adapter calls, and CAF recovery through production-controller tests
• update canonical CUJ, architecture, product, roadmap, and decision documentation

Verification

• 475 tests in 71 suites pass on the host
• strict Swift format, C format, shell syntax, diff, and local Markdown-link checks pass
• optimized product build passes
• signed canonical app verified and running from /Applications with unchanged 1.4.1 (17)

[MarcusJRLee]

Integrated into dev through rebase-merged rollup PR #34. This intermediate PR remains preserved as the focused review record for its original slice.