v2.9.0 — 360 round 2: 4-bit local model, Liquid Glass overlay, VoiceOver, paste hardening

[StevenACZ]

Summary

Phase B of the 360° round-2 audit, plus the release cut for v2.9.0.

• Local engine: quantized-checkpoint loader + new Large V3 Turbo (4-bit) tier (464 MB, ~⅓ RAM), decode-loop cancellation hook, HF downloads pinned to commit revisions.
• Overlay: Liquid Glass pill + dock chip on macOS 26 with fused detach/absorb (exact material fallback on 14/15), blur-replace content swaps, VoiceOver labels + phase announcements, real Button for the dock chip, phantom Settings scene fixed (Cmd+, routes to the real window).
• Settings/History/Welcome: WCAG text contrast (adaptive green text + real AccentColor), scrubber/vocab-chip accessibility, shared engine-color map, DateFormatter caching, KeycapView/ShakeEffect extracted, export sensitive-content notice, motion-token sweep (+transition/shake tokens).
• Robustness: all remaining unguarded AVFAudio calls routed through AudioEngineGuard, MLX unload/load generation checks, History DB corruption recovery, retry/re-transcribe unified into the pipeline, AppState transition table (log-only).
• Privacy/supply chain: pre-paste sanitizer (control/ANSI/bidi/zero-width), ConcealedType clipboard marking, 0o700 storage, SHA-pinned Actions, entitlement cleanup, SECURITY.md.

Testing

• make ci-check green (292 tests), make release-check passed (v2.9.0, build 13).
• Per-file warning sweep: no new strict-concurrency warnings.
• Live QA on macOS 26: glass overlay, Cmd+, routing, turboQ4 download + dictation.