Modernize desktop experience and prepare 0.4.6 RC3

[RioPlay]

Summary

• modernize the desktop shell, landing/status surface, Settings, and supporting windows without changing the Tk architecture
• add consistent Ready, Listening, Processing, and Error presentation plus guided microphone, model, save, backup, diagnostic, and file recovery
• add fixed-catalog local model presentation, Settings search, keyboard/focus improvements, section reset, and deterministic capture coverage
• revalidate the effective OS-default audio route before each explicit stream preparation while preserving fail-closed named-device behavior
• prepare the honest 0.4.6rc3 Windows preview identity, notes, and release-readiness ledger
• make the Windows packaging script invoke PyInstaller through the selected interpreter for relocatable/junctioned environments

Verification

• 250 audio and applied-model readiness tests passed
• 16 Recording feedback section-reset tests passed
• 17 privacy, config, and repository-boundary tests passed
• 31 packaging policy/notices/runtime-notices tests passed
• Windows CPU onedir build completed with 43-package notices and no bundled transcription weights
• packaged help, offline doctor, polish/list formatting, invalid clipboard-worker behavior, GUI-subsystem check, and frozen Settings launch passed
• local RC3 archive integrity and all three internal executable SHA-256 values verified
• independent desktop diff review found no blocking correctness, privacy, security, dependency, or framework-migration defect

The last complete unmodified source run before the final reset/audio slices passed 2,648 tests with 14 expected skips. The current managed-host full-suite attempt reached 1,345 passed and 11 skips before the unchanged Windows OBS child-pipe fixture exceeded its eight-second watchdog. A diagnostic temp-permission shim is not counted as release evidence because it invalidates OBS ACL semantics. CI must provide the clean exact-revision receipt.

Release boundary

This PR prepares desktop-v0.4.6-rc.3; it does not publish the tag or prerelease. The local build is unsigned. Physical microphone/hotplug identity, screen-reader/UIA, mixed-DPI, whole-app/tray performance, clean installed builds, macOS/Linux behavior, signing, and publication remain explicit gates.