Fix Voxtype installation on ARM64 guests

[Fail-Safe]

Summary

• add a reproducible, opt-in ARM64 voxtype-bin 1.0.1-1 package to the immutable guest repository
• verify the official signed source archive and all six signed ARM64 release assets before packaging
• make gtk4-layer-shell and which hard runtime dependencies so the default GTK OSD starts and Voxtype can discover the wtype installed by Omarchy
• keep Voxtype out of the factory image until the user invokes the existing Omarchy Dictation installer
• extend the launcher supply-chain identity, third-party notices, final image checks, and guest regression contract

Problem

The Omarchy Dictation installer requests voxtype-bin, but that target is unavailable on the ARM64 guest. Installing the official Voxtype binary manually exposed two additional runtime failures:

1. the GTK4 OSD could not load libgtk4-layer-shell.so.0
2. Voxtype 1.0.1 could not discover an installed /usr/bin/wtype because it invokes the external which utility

Encoding both requirements in the generated package makes the existing installer complete the setup in one transaction.

Supply-chain controls

• pin Voxtype v1.0.1 source, release key, six ARM64 assets, signatures, and SHA-256 digests
• require signing fingerprint 9CCF7915B750CAE8B095ED1AA3FC9F33FD209279
• reject unsafe source archive members and non-AArch64 ELF assets
• execute both CPU and ONNX variants during the guest build and verify their reported identity
• pin the reviewed Voxtype component identity in the native launcher

Validation

• make doctor: passed on Apple Silicon macOS 27
• guest suite: 54 tests passed; full guest contract and Bash syntax checks passed
• Swift suite: 161 tests across 40 suites passed; the local macOS 27 Command Line Tools installation required supplying its misplaced Testing runtime to SwiftPM
• macOS compatibility, runtime relocation, port-forwarding, SSH, power-action, and persistent-storage suites passed
• full guest, pinned QEMU runtime, and macOS app build passed; strict/deep code-signature and macOS 15 compatibility checks passed
• the full build required a temporary refresh of the unrelated stale libbluray lock from 1.5.0-1 to the currently signed 1.5.1-1; that lock change is intentionally not included here

Live acceptance in an ARM64 guest:

• the unchanged Omarchy Dictation installer installed voxtype-bin 1.0.1-1
• the daemon, Whisper model, and GTK4 OSD started successfully
• a 12.0-second recording transcribed in 0.98 seconds
• the resulting text was inserted through wtype