fix: segment time units, params pointer lifetimes, getter bounds checks

[rmorse]

Summary

Fixes existing bugs found while reviewing the crate for the whisper.cpp 1.9 upgrade.

• Segment times are now milliseconds (breaking). whisper.cpp reports segment times in centiseconds; full_get_segment_timestamps() passed them through, so Segment::start_ms/end_ms, start_seconds()/end_seconds() and WhisperStreamPcm::run callback times were 10x too small. Fixed at the single conversion point, which covers transcribe*, WhisperStream, WhisperStreamPcm and the fallback transcriber.
• Use-after-free in FullParams::suppress_regex(). The CString was dropped at the end of the setter while whisper.cpp kept the pointer.
• Dangling FullParams::prompt_tokens(). It stored a borrowed slice pointer in a Clone + Send + Sync struct. Tokens are now copied.
• Unchecked getter indices (breaking). whisper.cpp's result getters don't bounds-check, so out-of-range indices were UB from safe code. Result/Option getters now return Err/None; plain-value getters panic like slice indexing (documented under # Panics).
• Added WhisperState::full_get_segment_no_speech_prob(), replacing a raw FFI call in the fallback transcriber.

The language/initial_prompt setters no longer write pointers into the inner struct either; as_raw() is the single place pointers are wired up, and it is the only path params take to C.

Notes

• Originally stacked on chore: update whisper.cpp pin to 1.9.4-dev (stream-pcm de8fb5fd) #13 (the repin); rebased onto develop after chore: update whisper.cpp pin to 1.9.4-dev (stream-pcm de8fb5fd) #13 merged.
• WhisperState::full_parallel is also broken (upstream writes results to the context's default state, which the wrapper never reads) but is not changed here. It will be reimplemented in Rust in a follow-up.
• The raw whisper_token_data from full_get_token_data() is left unchanged and now documented as centiseconds.
• Both breaking changes are called out in the CHANGELOG; they point to a 0.2.0 release.

Validation

Windows / MSVC, test models from cargo xtask test-setup:

• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets -- -D warnings
• cargo clippy -p whisper-cpp-plus --all-targets --features async -- -D warnings
• cargo test --workspace -- --test-threads=1: 124 passed, none skipped
• cargo test -p whisper-cpp-plus --features async -- --test-threads=1: 112 passed
• cargo doc -p whisper-cpp-plus --no-deps: no warnings

New tests:

• params unit tests: string params and prompt tokens stay valid after the original params are cloned and dropped; None/empty map to null.
• real_audio: jfk.wav's last segment ends near the audio length in ms (the old code gave ~1/10th); every getter rejects out-of-range indices with Err/None/panic.

[rmorse]

Closing and reopening to trigger CI after retargeting to develop.