feat: native search workbench, embedded tgrep and offline ANE ranking

[loadchange]

Summary

• Native SwiftUI/AppKit search workbench, keyboard-first navigation and responsive, accessible waiting states; macOS 26 glass APIs with macOS 13 fallbacks.
• Remove SQLite FTS creation, updates, querying and fallback. tgrep is the only postings index; SQLite retains metadata and independently compressed 32 KiB text blocks.
• Resume legacy conversion in bounded passes, retire FTS and reclaim space. Preserve transcript identities, metadata, snippets and message anchors. Initialize incremental vacuum before WAL so new catalogs actually reclaim pages.
• Publish the first verified, openable result before full occurrence counting. Keep selection and anchors stable, reject stale/reordered snapshots, and show honest lower-bound counts.
• Safely reclaim abandoned lease-validated tgrep working directories; conservatively retain legacy unmarked caches.
• Offline Core ML MiniLM ordering uses CPU+ANE policy on Apple Silicon and CPU fallback. It only ranks existing exact results and does not send conversation content over the network.
• Fix immediate gateway restart/listener cancellation and isolate UI fixtures in private temporary directories compatible with XCTest's sandbox, without changing OS privacy policy.

Real local-history evidence

Only derived private copies were migrated. No private histories, databases, titles, paths, snippets, screenshots or credentials are committed or uploaded.

• Full independent migration verification: 1,571 session rows, 1,458 transcripts, 25,216 chunks and 324,441 message spans; every transcript's SHA-256 and all metadata/anchors matched.
• SQLite + WAL/SHM: 4.277 GB → 302 MB. New SQLite + tgrep checkpoint: 1.103 GB, excluding retained old unmarked caches. This is not a claim that the tgrep index itself shrank.
• 当前版本: first usable hit 31.5–56.6 ms, complete counts 242.0–475.6 ms for first use of the keyword with a prepared index. 系统代理 after process restart: 603.5 ms to first hit, including checkpoint restoration. Exact-cache repeats complete in approximately 25–28 ms.
• Initial tgrep preparation without a checkpoint still takes approximately 50 seconds. Frequent terms can still take seconds to count fully; results are already usable during counting.
• An independent full-corpus Foundation oracle found zero per-transcript count/first-position differences and zero missing candidate blocks for both required Chinese queries.
• Actual 459 MB / 16,921-message session: Store load + UI-data preparation 6.39 s, main-actor heartbeat max gap 16.8 ms; in-session search 0.73–0.81 s, active-search switch to a small session 7.2 ms. Private-copy live append and stale-result cancellation passed. These are not frame-paint/FPS measurements.

Methodology, storage caveats and cold/restored/repeated measurements: search-performance.md.

Verification

• Local native unit/integration: 868/868 passed, zero skipped, no retries; 11/11 real Bifrost/CLI integration cases, including installed Claude and Codex.
• Rust bridge: 22 tests passed (one pre-existing ignored benchmark); debug/release stress runs and strict clippy passed.
• Shared JavaScript suites passed; the optional legacy browser smoke was unavailable locally.
• Final unsigned universal app/helper/tgrep slices verified. All eight packaged self-checks passed, including real tgrep matching and bundled semantic inference with CPU+ANE policy.
• Local UI runner timed out enabling system automation before any UI case ran; this is not counted as a UI pass. Full UI verification is delegated to this PR's clean macOS CI, which enforces all named UI workflows and zero skips.
• The first CI run exposed an incompatible fixture root, now fixed. The second passed 868/868 native and 23/24 UI tests, exposing a real progressive-search ordering mismatch for tied timestamps. The repository and palette now share one deterministic order before prefix delivery and result limits, with three regression tests; the original UI assertions are unchanged.
• Exact-head verification for 02acab22e985746379a1478c0fb994bf727f54ad is pending: CI run 34358634188. Completion requires all native, UI, package, self-check and handoff gates to pass.

No merge or release is performed by this PR.