chore: add CI workflows, dev launcher, and linux capability schema

.github/workflows/check.yml: cargo check on Linux + Windows + macOS
  plus Svelte/Vite build on every push to main and every PR. Fast
  feedback without paying for the full release build.

.github/workflows/build.yml: cross-platform release build producing
  .AppImage/.deb (Linux), .msi/.exe (Windows), .dmg (macOS). Triggers
  on v* tag push (attaches to a draft GitHub Release) or manual
  workflow_dispatch. Signing stubs commented out pending cert decisions.

run.sh: dev launcher that starts Vite, waits for port 1420, then runs
  tauri dev with beforeDevCommand blanked to avoid a second Vite spawn.
  Restores tauri.conf.json on exit via trap.

src-tauri/gen/schemas/linux-schema.json: Tauri-generated capability
  schema for Linux; the other platform schemas (desktop, windows) were
  already committed. Adds the missing sibling.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/build.yml

@@ -0,0 +1,143 @@
+# Cross-platform release build. Produces installer artifacts for
+# Linux (.AppImage + .deb), Windows (.msi + .exe), macOS (.dmg + .app).
+#
+# Triggers:
+# - Manual: any branch via "Run workflow" in the GitHub Actions UI.
+#   Use this to build a Windows binary on demand to dual-boot test.
+# - Tag push (v*): builds + drafts a GitHub Release with all artifacts
+#   attached. Tag a release with `git tag v0.2.0 && git push --tags`.
+#
+# Artifacts:
+# - workflow_dispatch builds: uploaded as Action artifacts
+#   (visible in the run page, downloadable for 30 days).
+# - tag builds: attached to a draft GitHub Release named after the tag.
+#   Promote the draft to a release when ready.
+#
+# Signing:
+# - macOS code-signing not configured. The .dmg will trigger Gatekeeper
+#   warnings on the first run; users will need to right-click → Open.
+#   To wire signing later, set APPLE_SIGNING_IDENTITY +
+#   APPLE_CERTIFICATE secrets and uncomment the env block.
+# - Windows code-signing not configured. The .exe/.msi will trigger
+#   SmartScreen warnings on first run. To wire signing later, set
+#   WINDOWS_CERTIFICATE + WINDOWS_CERTIFICATE_PASSWORD secrets.
+name: build
+
+on:
+  push:
+    tags: ['v*']
+  workflow_dispatch:
+    inputs:
+      tag_name:
+        description: 'Optional tag name to attach the build to (leave blank for plain artifacts)'
+        required: false
+
+concurrency:
+  group: build-${{ github.ref }}
+  cancel-in-progress: false  # let release builds finish even on tag re-pushes
+
+jobs:
+  build:
+    name: build (${{ matrix.os }})
+    permissions:
+      contents: write  # needed to create draft releases on tag pushes
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-22.04
+            artifact_glob: |
+              src-tauri/target/release/bundle/appimage/*.AppImage
+              src-tauri/target/release/bundle/deb/*.deb
+          - os: windows-latest
+            artifact_glob: |
+              src-tauri/target/release/bundle/msi/*.msi
+              src-tauri/target/release/bundle/nsis/*.exe
+          - os: macos-latest
+            artifact_glob: |
+              src-tauri/target/release/bundle/dmg/*.dmg
+              src-tauri/target/release/bundle/macos/*.app
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # System packages — same as check.yml but locked to release-build needs.
+      - name: Install Linux deps
+        if: matrix.os == 'ubuntu-22.04'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libwebkit2gtk-4.1-dev \
+            libappindicator3-dev \
+            librsvg2-dev \
+            libasound2-dev \
+            libudev-dev \
+            patchelf \
+            cmake \
+            build-essential
+
+      - name: Install macOS deps
+        if: matrix.os == 'macos-latest'
+        run: |
+          brew list cmake >/dev/null 2>&1 || brew install cmake
+
+      - name: Install Windows deps
+        if: matrix.os == 'windows-latest'
+        shell: pwsh
+        run: |
+          cmake --version
+          choco install -y llvm --no-progress
+
+      - name: Install Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install Rust
+        uses: dtolnay/rust-toolchain@stable
+
+      - name: Cache Rust
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri -> target
+          shared-key: kon-build-${{ matrix.os }}
+
+      - name: Install JS deps
+        run: npm ci
+
+      # tauri-action handles `tauri build` plus, on tag pushes, attaches
+      # artifacts to a GitHub draft release. Empty tagName disables the
+      # release-creation behaviour for manual workflow_dispatch runs.
+      - name: Build (release)
+        uses: tauri-apps/tauri-action@v0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # Uncomment when signing certs are configured in repo secrets:
+          # APPLE_SIGNING_IDENTITY: ${{ secrets.APPLE_SIGNING_IDENTITY }}
+          # APPLE_CERTIFICATE: ${{ secrets.APPLE_CERTIFICATE }}
+          # APPLE_CERTIFICATE_PASSWORD: ${{ secrets.APPLE_CERTIFICATE_PASSWORD }}
+          # WINDOWS_CERTIFICATE: ${{ secrets.WINDOWS_CERTIFICATE }}
+          # WINDOWS_CERTIFICATE_PASSWORD: ${{ secrets.WINDOWS_CERTIFICATE_PASSWORD }}
+        with:
+          # If pushed as a tag, use the tag name; otherwise leave empty
+          # so tauri-action builds artifacts but does not touch releases.
+          tagName: ${{ github.ref_type == 'tag' && github.ref_name || (inputs.tag_name || '') }}
+          releaseName: ${{ github.ref_type == 'tag' && github.ref_name || (inputs.tag_name || '') }}
+          releaseDraft: true
+          prerelease: false
+          # Build all bundle types the OS supports.
+          args: ''
+
+      # Always upload as an Actions artifact too — accessible from the
+      # workflow run page even if the release-creation step was skipped.
+      - name: Upload artifacts
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: kon-${{ matrix.os }}-${{ github.sha }}
+          path: ${{ matrix.artifact_glob }}
+          retention-days: 30
+          if-no-files-found: warn

.github/workflows/check.yml

@@ -0,0 +1,105 @@
+# Per-push fast feedback: cargo check on Linux + Windows + macOS, plus
+# the Svelte build. Catches platform-specific compile errors (the M3
+# fix that broke on Windows because std::sync::mpsc::TryRecvError lives
+# in a different module on certain configurations, etc) without paying
+# the cost of the full Tauri release build.
+#
+# For the full installer build (.msi, .dmg, .AppImage) see build.yml.
+name: check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+# Cancel any earlier in-progress runs for the same branch — a fresh push
+# supersedes the previous one.
+concurrency:
+  group: check-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rust:
+    name: cargo check (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # System packages whisper-rs-sys + Tauri need on each OS.
+      # Linux is the heaviest because we depend on GTK/WebKit, audio,
+      # evdev, plus cmake for whisper.cpp.
+      - name: Install Linux deps
+        if: matrix.os == 'ubuntu-22.04'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libwebkit2gtk-4.1-dev \
+            libappindicator3-dev \
+            librsvg2-dev \
+            libasound2-dev \
+            libudev-dev \
+            patchelf \
+            cmake \
+            build-essential
+
+      # macOS: cmake is preinstalled in macos-latest but pin via brew to
+      # be explicit and future-proof.
+      - name: Install macOS deps
+        if: matrix.os == 'macos-latest'
+        run: |
+          brew list cmake >/dev/null 2>&1 || brew install cmake
+
+      # Windows: cmake + clang are needed by whisper-rs-sys. cmake is on
+      # windows-latest by default; ensure it.
+      - name: Install Windows deps
+        if: matrix.os == 'windows-latest'
+        shell: pwsh
+        run: |
+          # cmake is on the runner image; verify it.
+          cmake --version
+          # LLVM/clang for whisper.cpp's sources.
+          choco install -y llvm --no-progress
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      # Cache the Cargo target dir + registry per OS so the heavy
+      # whisper-rs-sys C++ build only happens on a clean cache.
+      - name: Cache Rust artifacts
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri -> target
+          shared-key: kon-${{ matrix.os }}
+
+      - name: cargo check (workspace)
+        working-directory: src-tauri
+        run: cargo check --workspace --all-targets
+
+  frontend:
+    name: svelte build + lint
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install JS deps
+        run: npm ci
+
+      # `tauri build` inside check.yml would trigger the full Rust build
+      # which is owned by the rust job. Here we only validate that the
+      # Svelte/Vite frontend compiles cleanly.
+      - name: Build frontend (Vite only)
+        run: npm run build