fix(rag): do not mark a document indexed when no chunk could be embedded

With the embedding server unavailable every chunk failed, yet the document
was stored as indexed=true with 0 chunks, so the knowledge base listed it as
searchable while queries could never match it. The red use-case test caught
this; it had been written off as an environment failure.

Now a run with zero embedded chunks leaves indexed=false and throws
RAGEmbeddingFailed (surfaced by reindex, logged by addDocument).

Tests that only hold on the Windows developer machine now declare it: the
bundled SoX binary and PowerShell device discovery run on win32 only, and
the sidecar venv test runs only when sidecar/.venv exists. The Linux Forgejo
runner skips them instead of failing.

apps/desktop/tests/main/services/windows-child-process-hide.test.ts

@@ -128,7 +128,8 @@ describe('Windows child process visibility', () => {
     expectWindowsHideOnAllCalls(childProcess.exec)
   })
 
-  it('hides Windows device discovery and active-window PowerShell calls', async () => {
+  // 장치 목록·활성 창 조회는 win32 분기에서만 PowerShell 을 부른다.
+  it.skipIf(process.platform !== 'win32')('hides Windows device discovery and active-window PowerShell calls', async () => {
     const audioModule = await import('../../../src/main/services/AudioCaptureService')
     const audioService = audioModule.getAudioCaptureService() as unknown as {
       _getDevicesWindows(): Promise<unknown>