fix: prevent unsolicited text insertion from silent recordings

[IchenDEV]

Incident and root cause

Four retained menu-bar sessions contain the long ordered Terms: ... list already in Qwen ASR rawText. The incident-era Qwen path passed that vocabulary as generate(context:); formatting changed only its presentation. The original audio and exact runtime prompt were not retained, so the sound that crossed the RMS gate is unknown.

Three separate older sessions contain raw 嗯。 and processed Do anything. An active auto-learned dictionary rule made that substitution before formatting. Its original source edits were pruned; their intent is unknown.

Revised fix

• Run the recorded-audio speech decision before final output in menu-bar, live integration, and imported-audio paths.
• Capture one app/language-scoped dictionary snapshot per session. Preserve manual global terms and post-ASR industry corrections. Qwen receives at most eight relevant personal terms within a 160-character term budget.
• Detect Qwen prompt echoes and retry once without context. A repeated echo or retry error cannot return the first transcript.
• Reject automatic learning from isolated filler sources. Existing unsafe learned entries are inert and appear pending without rewriting the user's dictionary; explicit approval or editing makes one manual.
• Integrate the latest main-branch session ownership and cancellation contract; rejected recordings cannot commit output/history.

Local evidence

• bash scripts/sdlc-checks.sh and bash scripts/ci-basic-checks.sh passed.
• Full local swift test --scratch-path /tmp/utter-silent-insertion-build: 793 XCTest cases, 18 skipped, zero failures; one Swift Testing case passed. Focused Qwen retry and dictionary tests also passed after that run.
• Installed local Qwen replay: generated noise rejected; repository English/Chinese samples transcribed; a synthetic rare name was misrecognized without a hint and recognized with one or three bounded hints. This is limited sample evidence.
• bash scripts/build-app.sh --app-only --sign=- passed release-style assembly, Metal bundling, and artifact verification. The ad-hoc signature is for local verification.

Remaining gates

This PR remains draft. Real computer-microphone/window QA awaits a clean run without the two other Utter instances currently active. Independent high-risk verification, PR approval, trusted signing, and protected production approval remain separate. No release is authorized by this PR.

Current intent, spec, approved plan, draft verification, and rollback notes: docs/sdlc/changes/2026-09-23-silent-input-insertion/.