feat: productize OxShift 0.3 Alpha with mixer/EQ and release hardening

[imedkablavi]

Goal

Move OxShift from development preview toward a usable 0.3 Alpha while preserving the realtime callback, local-first privacy boundary, and fail-closed audio behavior.

Product / UX

• default OxShiftProductUI shell with onboarding, routing readiness, device setup, mic probe, runtime controls, profiles, Soundboard editing/playlists, support diagnostics, and Audio performance controls
• dedicated Mixer / EQ page with vertical voice/Soundboard faders
• real 5-band voice EQ: 80 Hz / 250 Hz / 1 kHz / 4 kHz / 12 kHz, each limited to ±12 dB
• EQ presets: Flat, Broadcast, Deep, Warm, Bright, Telephone
• Voice Level + Pitch controls exposed next to EQ so tonal EQ and actual pitch shifting are clearly separated
• graphite/amber/green audio-console skin replacing the purple AI-dashboard presentation
• navigation renamed around audio workflow: Console, Voices, Mixer/EQ, Soundboard, Voice Lab, Profiles, Voice Models, Audio I/O
• Mixer page participates in saved navigation/keyboard shortcuts

DSP / reliability

• EQ is a real realtime DSP stage using persistent Pedalboard shelf/peak filters, not a visual-only control
• EQ sits in the reorderable/bypassable effect chain and preserves realtime state across blocks
• EQ settings persist per StudioProfile; profile schema upgraded to v5 with sanitization/clamping
• starter Gaming/Streaming/Calls profiles now include deliberate EQ defaults
• Reset-to-Clean returns EQ to flat
• CPU headroom preflight now measures the active EQ settings as part of the actual callback DSP budget
• no model validation, file decoding, device enumeration/reopen, or recording disk writes moved into the PortAudio callback

Bazzite / Linux fixes

• Bazzite uses Distrobox without host package layering
• installer pins Fedora /usr/bin/python3 inside the container instead of inheriting broken Linuxbrew Python from host shell setup
• installs python3-pip/Tk/PortAudio/libsndfile/compiler explicitly, recreates broken venvs, and performs per-module runtime verification
• global hotkeys are optional; failure of pynput/evdev no longer blocks core OxShift installation
• optional WebRTC cleanup remains best-effort

AI / model safety

• allow-listed oxshift-rvc-stream-v1 manifests only
• path containment, size, SHA-256, sample-rate and ONNX I/O validation
• raw ONNX/PTH imports remain quarantined; .pth execution disabled for Alpha
• model loading/validation remains outside the realtime callback and inference remains on the existing worker

Packaging / release engineering

• Windows + Linux PyInstaller packaging and packaged --help smoke tests
• Windows installer path with Inno Setup
• Linux portable archive
• SHA-256 + Cosign release workflow design
• safe staged update/rollback architecture; unattended self-update remains disabled until release trust-chain validation

Tests added/expanded

• mixer/EQ DSP safety, bounded output and actual tone-change test
• EQ profile sanitize + round-trip persistence tests
• existing Windows/Linux Python matrix, compileall, CLI smoke, realtime benchmark/stress, device preflight and product UX tests remain enabled

Current verification state

Current head is being validated by CI run #179. At the latest check, Windows/Linux Python test jobs and the realtime benchmark/stress job were queued; do not treat the new mixer/EQ work as fully CI-qualified until that run completes.

PR intentionally remains Draft.

Manual gates still required

• real Bazzite/Linux packaged UI + PipeWire routing test
• physical Linux USB/virtual-device disconnect/reconnect
• physical Windows WASAPI + VB-CABLE/VoiceMeeter routing/recovery
• 2+ hour paced hardware soak
• packaged Windows/Linux first-run/onboarding pass
• real screenshots/demo from packaged builds
• disposable prerelease tag proving checksum/Cosign/release upload end-to-end