feat(app): add crash visibility, memory relief, and clipboard reply work

Squashes the working tree that had accumulated on cloud-agent. Two
strands of work, kept in one commit at the maintainer's request.

Crash and stability (this session):

- Subscribe to MetricKit so crash, hang, CPU, and disk-write diagnostics
  are recorded on device. Keyboard-extension memory kills are the most
  likely way a user loses the keyboard mid-sentence and iOS does not
  classify them as crashes, so they never reach App Store Connect.
- Upload those reports to POST /v1/analytics/diagnostics from internal
  builds only (local Debug and TestFlight), reusing the analytics
  installation identifier and skipping entirely when analytics are off.
  App Store builds keep everything on device.
- Shed the Chinese engine, English lexicon, and in-flight pipeline work
  at the 40 MiB and 48 MiB budget thresholds instead of waiting for a
  system memory warning that jetsam often preempts.
- Install audio taps with the input node's live format through one
  shared adaptive resampler, so an audio-route change mid-recording no
  longer raises an uncatchable format-mismatch exception. Covers the
  dictation preview and the Mac recorder, which still used the pattern
  the Flow capture path had already moved away from.
- Harden the librime bridge: never pass a nil string across a nonnull
  boundary when a user dictionary holds malformed UTF-8, null-check the
  engine API vector, and distrust a candidate count without its array.
- Guard the expanded candidate grid against a list that shrinks while
  the collection view is still laying out against the previous count.
- Resolve localized text without the App Group so the screen shown when
  that container is missing renders its message instead of crashing on
  launch, which is the one situation it exists to handle.
- Gate CI on the App Group and Keychain wiring that the keyboard
  extension hard-depends on, with a self-test proving the check fails.

Clipboard, reply, and semantics (pre-existing working tree):

- Unify the reply center, refresh keyboard AI features, and add native
  event and reminder exporters.
- Expand clipboard semantic routing with authored corpora and a
  product-blind holdout, plus the scripts that build and validate them.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

OSGKeyboardShared/Services/FlowSessionKeys.swift

@@ -38,6 +38,11 @@ public enum FlowSessionKeys {
     public static let lastPiPArmAttemptAt = "flow.lastPiPArmAttemptAt.v1"
     /// Minimum gap between repeated proactive `startflow` jumps.
     public static let pipArmCooldown: TimeInterval = 45
+    /// Keyboard→host request for a companion Flow diagnostics snapshot. The
+    /// keyboard is the process that observes "the session never came up", but
+    /// only the host knows why it never published ready — this asks the host to
+    /// dump its own breadcrumb window alongside the keyboard's report.
+    public static let flowDiagnosticsDumpRequest = "flow.diagnosticsDumpRequest.v1"
     /// Wall-clock timestamp of the last utterance completion or session start.
     public static let lastActivityAt = "flow.lastActivityAt"
     /// One-shot token rotated by every host-process launch. State written by
@@ -77,7 +82,29 @@ public enum FlowSessionKeys {
     /// Maximum duration for a single keyboard utterance (3.5 minutes).
     public static let maxUtteranceDuration: TimeInterval = 210
     /// User action → proven audio. Shared by normal dictation and edit mode.
+    /// Correct for a host that is already alive (warm handoff); a cold-start
+    /// jump uses the launch budget below instead.
     public static let utteranceStartBudget: TimeInterval = 8
+
+    /// Cold-start `startflow` jump: soft budget anchored at the jump itself
+    /// (not the mic press) so it covers host foreground + PiP arm + first ready
+    /// publish. Anchoring at the press charged app-launch latency against the
+    /// recording budget and timed out legitimate cold starts.
+    public static let coldStartHostLaunchBudget: TimeInterval = 12
+
+    /// Absolute cap for a cold-start jump, even while the host keeps
+    /// acknowledging that it is warming. Bounds the wait when the host is stuck
+    /// in the background and the user never brings it forward.
+    public static let coldStartHostLaunchHardCap: TimeInterval = 20
+
+    /// Each fresh host start-acknowledgement pushes the soft cold-start budget
+    /// out to `now + this` (capped by the hard cap).
+    public static let hostStartAckExtension: TimeInterval = 6
+
+    /// A ready snapshot whose `heartbeatAt` is within this window counts as a
+    /// live "host is warming" acknowledgement. Kept short so a stale snapshot
+    /// from a dead/suspended host cannot keep extending the budget.
+    public static let hostStartAckFreshInterval: TimeInterval = 4
     /// Edit stop → reviewed result delivered to the keyboard.
     public static let editLastInputProcessingBudget: TimeInterval = 45
     /// Host work budget leaves five seconds for serialization and delivery.