chore: add CI workflows, dev launcher, and linux capability schema

.github/workflows/check.yml: cargo check on Linux + Windows + macOS
  plus Svelte/Vite build on every push to main and every PR. Fast
  feedback without paying for the full release build.

.github/workflows/build.yml: cross-platform release build producing
  .AppImage/.deb (Linux), .msi/.exe (Windows), .dmg (macOS). Triggers
  on v* tag push (attaches to a draft GitHub Release) or manual
  workflow_dispatch. Signing stubs commented out pending cert decisions.

run.sh: dev launcher that starts Vite, waits for port 1420, then runs
  tauri dev with beforeDevCommand blanked to avoid a second Vite spawn.
  Restores tauri.conf.json on exit via trap.

src-tauri/gen/schemas/linux-schema.json: Tauri-generated capability
  schema for Linux; the other platform schemas (desktop, windows) were
  already committed. Adds the missing sibling.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/workflows/check.yml

@@ -0,0 +1,105 @@
+# Per-push fast feedback: cargo check on Linux + Windows + macOS, plus
+# the Svelte build. Catches platform-specific compile errors (the M3
+# fix that broke on Windows because std::sync::mpsc::TryRecvError lives
+# in a different module on certain configurations, etc) without paying
+# the cost of the full Tauri release build.
+#
+# For the full installer build (.msi, .dmg, .AppImage) see build.yml.
+name: check
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+# Cancel any earlier in-progress runs for the same branch — a fresh push
+# supersedes the previous one.
+concurrency:
+  group: check-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  rust:
+    name: cargo check (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, windows-latest, macos-latest]
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 30
+
+    steps:
+      - uses: actions/checkout@v4
+
+      # System packages whisper-rs-sys + Tauri need on each OS.
+      # Linux is the heaviest because we depend on GTK/WebKit, audio,
+      # evdev, plus cmake for whisper.cpp.
+      - name: Install Linux deps
+        if: matrix.os == 'ubuntu-22.04'
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libwebkit2gtk-4.1-dev \
+            libappindicator3-dev \
+            librsvg2-dev \
+            libasound2-dev \
+            libudev-dev \
+            patchelf \
+            cmake \
+            build-essential
+
+      # macOS: cmake is preinstalled in macos-latest but pin via brew to
+      # be explicit and future-proof.
+      - name: Install macOS deps
+        if: matrix.os == 'macos-latest'
+        run: |
+          brew list cmake >/dev/null 2>&1 || brew install cmake
+
+      # Windows: cmake + clang are needed by whisper-rs-sys. cmake is on
+      # windows-latest by default; ensure it.
+      - name: Install Windows deps
+        if: matrix.os == 'windows-latest'
+        shell: pwsh
+        run: |
+          # cmake is on the runner image; verify it.
+          cmake --version
+          # LLVM/clang for whisper.cpp's sources.
+          choco install -y llvm --no-progress
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+
+      # Cache the Cargo target dir + registry per OS so the heavy
+      # whisper-rs-sys C++ build only happens on a clean cache.
+      - name: Cache Rust artifacts
+        uses: Swatinem/rust-cache@v2
+        with:
+          workspaces: src-tauri -> target
+          shared-key: kon-${{ matrix.os }}
+
+      - name: cargo check (workspace)
+        working-directory: src-tauri
+        run: cargo check --workspace --all-targets
+
+  frontend:
+    name: svelte build + lint
+    runs-on: ubuntu-22.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+
+      - name: Install JS deps
+        run: npm ci
+
+      # `tauri build` inside check.yml would trigger the full Rust build
+      # which is owned by the rust job. Here we only validate that the
+      # Svelte/Vite frontend compiles cleanly.
+      - name: Build frontend (Vite only)
+        run: npm run build