Prepare Record 1.0.1 reliability fixes

[aindaco1]

Summary

• keep Open at Login actionable when SMAppService.mainApp initially reports .notFound, remove the obsolete LaunchAgent installer, and surface the real registration error
• preserve TCC identity across updates with a Developer ID bundle/team/designated-requirement release gate
• detect missing Parakeet v3, link to FluidInference's immutable verified revision, and atomically import an allowlisted model only after exact size and SHA-256 verification
• show MacWhisper only when MacWhisper, its bundled mw, and Record's content-checked sandbox bridge are available; provision the bridge from the signed app bundle
• publish the 1.0.1 changelog/release notes/model guide/ADR and a complete issue triage; close Enforce and test Record's no-network product boundary #22 and Implement recording-name templates and local Gifski handoff #29 and label the remaining board by release horizon

Security and performance

• Record retains no main-app network entitlement; model downloads remain external and user initiated
• model hashing streams 1 MiB chunks, rejects symlink traversal, stages on the destination volume, re-verifies, and rolls back on replacement failure
• an unexpected signing team, bundle identifier, Developer ID requirement, or missing hardened runtime blocks the release
• the MacWhisper bridge is compared byte-for-byte with the signed bundle resource before it is offered to the sandboxed app

Validation

• ./scripts/ci/validate.sh: 163 tests, 1 optional fixture skipped, 0 failures; arm64 release build passed
• RECORD_VERSION=1.0.1 RECORD_BUILD_NUMBER=2 ./scripts/ci/local-gate.sh: Podman lint, normal tests, ThreadSanitizer, AddressSanitizer, arm64 assembly, entitlement/offline checks, ZIP/DMG packaging, signed-feed fixture, and checksums passed
• ./scripts/ci/check-tcc-identity.sh /Applications/Record.app: v1.0.0 baseline verified as com.aindaco.record / PWT3Q52LZ2
• focused installer/login/MacWhisper/menu suite: 22 tests, 0 failures

Follow-up

• FluidAudio manifest warning fix: Exclude Parakeet benchmark documentation from target FluidInference/FluidAudio#837
• Complete offline Parakeet import and typed v2/v3 selection #24 remains open for first-class Parakeet v2 selection/import
• Replace the transitional LaunchAgent with an app-bundle lifecycle #23 remains open until the notarized 1.0.0 → 1.0.1 TCC-retention smoke test completes