fix: red-team round 3 hardening across desktop, mobile, core and server

Batch of red-team r3 fixes that were in the working tree before the
2026-09-28 design overhaul, committed as one unit with their tests.

- desktop main: STT timeouts and sidecar, voice recording store, sync
  (credentials, audio, knowledge reindex, push gates), runtime
  provisioner, update policy, AltGr keybindings, voice-command policy,
  dictionary file codec/limits, meeting transcript condensing and a
  local recording ledger so interrupted-session recovery only closes
  meetings this device recorded (a phone's live meeting is left alone).
- mobile: login CSRF via implicit token callbacks rejected, account
  deletion/retention, durable queue retention, knowledge realtime
  without unfiltered DELETE, meeting re-record failure paths, cloud STT
  client, preferences store/resync.
- core: text chunking splits long unbroken transcripts to fit, template
  field policy, dictionary limits, meeting markdown inline handling.
- server: payple webhook policy and cancellation order scope, meeting
  document generation quota, team RPC null-role guard, unified LLM
  quota in-flight accounting, knowledge chunk vector index, meeting
  re-record failure paths (migrations 20260929*).
- ci: portable/runtime feed gates, update-policy schema, Forgejo file
  delete and alias planning.

Four older tests are updated to the new contracts rather than the old
behavior: token-pair auth callbacks are rejected, knowledge realtime no
longer subscribes to DELETE, long transcript lines are split, and
meeting recovery requires the local recording ledger for empty rows.

scripts/ci/publish-forgejo-release.mjs

@@ -31,6 +31,13 @@ import {
   uploadImmutableAsset,
 } from "./lib/immutable-package-guard.mjs";
 import { publishLatestAlias, readPublishedFeedVersion } from "./lib/latest-feed-guard.mjs";
+import {
+  RUNTIME_MIN_VERSION_SOURCE,
+  WINDOWS_X64_TARGET,
+  assertRuntimeFeedCompatible,
+  parseRuntimeMinVersions,
+} from "./lib/runtime-feed-gate.mjs";
+import { assertValidUpdatePolicy } from "./lib/update-policy-schema.mjs";
 
 const { forgejoAuthorization } = credentialHelpers;
 
@@ -68,13 +75,8 @@ if (tag !== `v${productVersion.version}`) {
 }
 
 const policyPath = fileURLToPath(new URL("../../release/update-policy.json", import.meta.url));
-const policyRaw = readFileSync(policyPath);
-try {
-  const policy = JSON.parse(policyRaw.toString("utf8"));
-  if (policy.schemaVersion !== 1) throw new Error("unsupported schemaVersion");
-} catch (error) {
-  throw new Error(`update-policy.json is invalid: ${error instanceof Error ? error.message : String(error)}`);
-}
+// schemaVersion 만 보면 "killSwitch": "true" 같은 오타가 클라이언트에서 가장 허용적인 값으로 바뀐다.
+assertValidUpdatePolicy(readFileSync(policyPath), "release/update-policy.json");
 
 const releaseDirectory = process.env.FORGEJO_RELEASE_DIR?.trim()
   ? process.env.FORGEJO_RELEASE_DIR.trim()
@@ -109,6 +111,20 @@ if (dryRun) {
   process.exit(0);
 }
 
+// 런타임 게이트 — 이 빌드의 RUNTIME_MIN_VERSION 을 runtime-latest 가 만족하지 못하면 어떤 파일도
+// 올리기 전에 멈춘다. release.yml 과 portable.yml 은 같은 태그에서 서로 기다리지 않고 돌기 때문에,
+// 최소 버전을 올린 릴리스는 런타임 게시가 끝난 뒤 이 job 을 다시 실행해야 한다.
+const runtimeFeedUrl = `${origin}/api/packages/${owner}/generic/${PACKAGE_NAME}/runtime-latest/runtime.json`;
+const runtimeFeed = await assertRuntimeFeedCompatible({
+  url: runtimeFeedUrl,
+  fetchImpl: forgejoFetch,
+  minVersions: parseRuntimeMinVersions(
+    readFileSync(fileURLToPath(new URL(`../../${RUNTIME_MIN_VERSION_SOURCE}`, import.meta.url)), "utf8"),
+  ),
+  target: WINDOWS_X64_TARGET,
+});
+process.stdout.write(`  runtime-latest ${runtimeFeed.version} satisfies this build's runtime minimum\n`);
+
 // 0) 이미 게시된 버전은 재게시하지 않는다 (SemVer 동일 버전 재릴리스 금지).
 //    버전별 경로의 원격 sha256이 로컬과 같으면 재시도/재실행으로 보고 건너뛰고,
 //    다른 바이트(재빌드·재서명된 설치본 등)가 있으면 어떤 파일도 건드리기 전에 fail-closed로 중단한다.