Add cross-platform runtime and Windows/Linux shipping

[brxs]

What changed

This branch combines the reviewed implementation package for running and shipping LSDJ on macOS, Linux, and Windows:

• native cross-platform paths, environment isolation, process-tree supervision, and authenticated local service transport;
• a pinned external PyTorch MRT2 dependency for managed Linux/Windows runtimes, with one shared two-deck worker and serialized CUDA ownership;
• the official Stable Audio 3 TFLite baseline, plus a fail-closed optional Windows CUDA candidate that remains disabled for release;
• hash-verified per-service runtime installation, recovery-safe promotion, provenance, LoRA management, cancellation, and diagnostics;
• live audio-output health, route retention, reconnect, serialized device transitions, and atomic combined master/cue ring swaps;
• Linux AppImage and Windows NSIS packaging, an exact macOS/Linux/Windows producer union, and platform diagnostics;
• hardened Windows install/upgrade/downgrade/uninstall behavior, including owned-root validation, reparse-point defenses, fail-closed destructive purge, Unicode/space paths, and documented NSIS worker exit semantics;
• fail-closed AppImage layout auditing, release CODEOWNERS coverage, and hosted tests for runtime/GPU/render/path safety contracts.

Architecture decisions

• MRT2 remains an external, pinned, credited dependency; LSDJ does not vendor or maintain a fork.
• Managed Linux/Windows builds resolve separate MRT2 and SA3 services. Bundled macOS behavior remains supported.
• Release builds do not fall back to arbitrary system Python or an obsolete single-backend launcher.
• SA3 CUDA is explicitly not release-qualified. MRT2 currently holds its GPU lease for the worker lifetime, so safe concurrent SA3 CUDA requires a future two-level broker and hardware qualification. The public release path stays on TFLite.

Validation

Local combined head:

• frontend: 672 tests, lint, type-check, and production build;
• Rust: 440 default tests and 452 managed-runtime tests; default and managed Clippy; managed release build;
• backend shared groups: 178 portable-service tests, 26 model-free deck tests, and 157 model/runtime/GPU/render/path safety tests;
• release and packaging: 40 contracts, Ruff formatting/lint, exact three-producer policy, AppImage adversarial audit, and Windows lifecycle contracts;
• independent whole-branch architecture/security review: approved with no remaining code findings.

Hosted validation passed for exact head 01ccaca637accca82210e6ed86b72c24e1fd06c7 in CI run 31334707264:

• shared checks on macOS, Ubuntu, and Windows;
• managed-runtime tests, lint, and release build on Windows;
• Ubuntu 22.04 AppImage build, adversarial audit, Unicode/space-path smoke, and evidence upload;
• both Windows installers, fail-closed unsigned-release verification, install/upgrade/downgrade/uninstall lifecycle, and artifact upload.

The focused Windows source branch also passed its independent three-platform and installer-lifecycle run at exact head 39a480b2d512c6883ef2d3afa6d0f62f684434d4: CI run 31333418976.

Remaining external gates

• physical ALSA/PipeWire/WASAPI, FLX4, hotplug, suspend/resume, Wayland/Xorg, and NVIDIA qualification;
• Authenticode provider/certificate identity and protected signing environment;
• owner decisions and notices tracked separately in Add third-party model licensing, attribution, and download acknowledgement #108;
• SA3 CUDA VRAM/performance/driver qualification and gated artifact provenance tracked in Add optional PyTorch/CUDA acceleration for Stable Audio 3 on Windows #114.

Related to #107, #108, #109, #110, #111, #112, #113, and #114.