feat(app): add crash visibility, memory relief, and clipboard reply work

Squashes the working tree that had accumulated on cloud-agent. Two
strands of work, kept in one commit at the maintainer's request.

Crash and stability (this session):

- Subscribe to MetricKit so crash, hang, CPU, and disk-write diagnostics
  are recorded on device. Keyboard-extension memory kills are the most
  likely way a user loses the keyboard mid-sentence and iOS does not
  classify them as crashes, so they never reach App Store Connect.
- Upload those reports to POST /v1/analytics/diagnostics from internal
  builds only (local Debug and TestFlight), reusing the analytics
  installation identifier and skipping entirely when analytics are off.
  App Store builds keep everything on device.
- Shed the Chinese engine, English lexicon, and in-flight pipeline work
  at the 40 MiB and 48 MiB budget thresholds instead of waiting for a
  system memory warning that jetsam often preempts.
- Install audio taps with the input node's live format through one
  shared adaptive resampler, so an audio-route change mid-recording no
  longer raises an uncatchable format-mismatch exception. Covers the
  dictation preview and the Mac recorder, which still used the pattern
  the Flow capture path had already moved away from.
- Harden the librime bridge: never pass a nil string across a nonnull
  boundary when a user dictionary holds malformed UTF-8, null-check the
  engine API vector, and distrust a candidate count without its array.
- Guard the expanded candidate grid against a list that shrinks while
  the collection view is still laying out against the previous count.
- Resolve localized text without the App Group so the screen shown when
  that container is missing renders its message instead of crashing on
  launch, which is the one situation it exists to handle.
- Gate CI on the App Group and Keychain wiring that the keyboard
  extension hard-depends on, with a self-test proving the check fails.

Clipboard, reply, and semantics (pre-existing working tree):

- Unify the reply center, refresh keyboard AI features, and add native
  event and reminder exporters.
- Expand clipboard semantic routing with authored corpora and a
  product-blind holdout, plus the scripts that build and validate them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

OSGKeyboardMac/MacAudioRecorder.swift

@@ -23,11 +23,9 @@ final class MacAudioRecorder: MacAudioRecording, @unchecked Sendable {
         var errorDescription: String? {
             switch self {
             case .converterUnavailable:
-                return "无法初始化音频转换器 / Failed to initialize audio converter"
+                return MacL10n.string("mac.error.converterUnavailable")
             case .microphoneAccessDenied:
-                return "麦克风权限被拒绝——请在「系统设置 → 隐私与安全性 → 麦克风」中启用"
-                    + " / Microphone access denied — enable it in System Settings"
-                    + " → Privacy & Security → Microphone"
+                return MacL10n.string("mac.error.microphoneAccessDenied")
             }
         }
     }
@@ -39,7 +37,11 @@ final class MacAudioRecorder: MacAudioRecording, @unchecked Sendable {
         channels: 1,
         interleaved: false
     )!
-    private var converter: AVAudioConverter?
+    /// Route-adaptive resampler shared with the iOS capture paths. It rebuilds
+    /// its converter from the format of each incoming buffer, so switching
+    /// between the built-in mic, AirPods and a USB interface mid-recording
+    /// resamples correctly instead of feeding a converter a stale rate.
+    private var downsampler: FlowAdaptiveDownsampler?
     private let lock = NSLock()
     private var samples: [Float] = []
     private var snapshotContinuation: AsyncStream<AudioBufferSnapshot>.Continuation?
@@ -63,9 +65,6 @@ final class MacAudioRecorder: MacAudioRecording, @unchecked Sendable {
     /// whole excess in one move instead.
     private static let trimHysteresisSamples = 30 * 16_000
     private var smoothedLevel: Float = 0
-    /// One-shot flag for the converter pull block. Taps are serialized per
-    /// bus, so a plain instance property (not a captured local) is safe here.
-    private var didProvideInput = false
 
     /// Normalised input level (0…1), smoothed for a calm waveform.
     /// Read from the main thread by a polling timer while recording.
@@ -162,12 +161,20 @@ final class MacAudioRecorder: MacAudioRecording, @unchecked Sendable {
 
         let input = engine.inputNode
         let inputFormat = input.outputFormat(forBus: 0)
-        guard let converter = AVAudioConverter(from: inputFormat, to: targetFormat) else {
+        // Pre-flight only: the converter actually used on the audio thread is
+        // built by the downsampler from the first delivered buffer. Probing here
+        // still turns "no usable input device" into a clean thrown error.
+        guard AVAudioConverter(from: inputFormat, to: targetFormat) != nil else {
             throw RecorderError.converterUnavailable
         }
-        self.converter = converter
+        self.downsampler = FlowAdaptiveDownsampler(targetFormat: targetFormat)
 
-        input.installTap(onBus: 0, bufferSize: 4_096, format: inputFormat) { [weak self] buffer, _ in
+        // `format: nil` — NEVER pass an explicit format. `installTap` raises an
+        // uncatchable NSException ("Failed to create tap due to format
+        // mismatch") when the format read above has already been superseded by
+        // a route change, and that kills the whole app. `nil` always resolves
+        // to the node's live format.
+        input.installTap(onBus: 0, bufferSize: 4_096, format: nil) { [weak self] buffer, _ in
             self?.appendResampled(buffer)
         }
         engine.prepare()
@@ -202,26 +209,17 @@ final class MacAudioRecorder: MacAudioRecording, @unchecked Sendable {
     }
 
     private func appendResampled(_ buffer: AVAudioPCMBuffer) {
-        guard let converter else { return }
-        let ratio = targetFormat.sampleRate / buffer.format.sampleRate
-        let capacity = AVAudioFrameCount(Double(buffer.frameLength) * ratio) + 1_024
-        guard let output = AVAudioPCMBuffer(pcmFormat: targetFormat, frameCapacity: capacity) else { return }
-
-        didProvideInput = false
-        var conversionError: NSError?
-        converter.convert(to: output, error: &conversionError) { [self] _, statusPointer in
-            if didProvideInput {
-                statusPointer.pointee = .noDataNow
-                return nil
-            }
-            didProvideInput = true
-            statusPointer.pointee = .haveData
-            return buffer
-        }
-        guard conversionError == nil, let channel = output.floatChannelData else { return }
+        guard let downsampler else { return }
+        // The downsampler owns the frame-count arithmetic (it clamps before
+        // converting to `AVAudioFrameCount`, which traps on NaN/overflow) and
+        // the one-shot pull flag.
+        guard case .converted(let output) = downsampler.convertReusingScratch(buffer),
+              let channel = output.floatChannelData else { return }
 
         let frameCount = Int(output.frameLength)
         guard frameCount > 0 else { return }
+        // `output` is the downsampler's reusable scratch buffer, valid only
+        // until the next callback — copy the samples out synchronously.
         let chunk = Array(UnsafeBufferPointer(start: channel[0], count: frameCount))
 
         // RMS → rough 0…1 level with an attack/decay smoothing so the UI