chore(build): uv tooling, a Python 3.11 floor, and verified model downloads (epic #701, phases 2.5 & 5) (#713)

* chore(build): migrate justfile tooling to uv

All recipes now run through 'uv run' against .venv, with a shared
DEV_EXTRAS variable (dev + vad) because uv syncs the environment
exactly and would otherwise uninstall the dev tools between
recipes. 'deps' installs dev+vad; new 'deps-all' covers every
extra. 'build' switches to 'uv build'; 'version' uses --no-sync.

Bump [tool.uv] required-version to >=0.12,<0.13 for uv 0.12.x, and
raise the mypy python_version target to 3.12: mypy 1.19 in the lock
cannot target 3.9 and numpy 2.x stubs need a 3.12 target to parse
(mypy is not run in CI or pre-commit; this only affects 'just
typecheck').

* fix(tests): isolate test runs from real XDG state; fix Arch model-path crash

Local test runs failed en masse (185 failures) while CI stayed
green: tests picked up the developer's real ~/.local/share/vocalinux
models via the default XDG paths and switched IBus/keyboard code
paths through the desktop session env (XDG_CURRENT_DESKTOP/
XDG_SESSION_TYPE on GNOME/Wayland, issue #478 branches). conftest
now points XDG base dirs at a throwaway session-wide directory and
clears session variables at import time, mirroring a fresh CI
runner (paths like MODELS_DIR freeze at first import during
collection, so fixture-time isolation is too late).

Also guard the Arch branch of _get_system_model_paths(): it removed
/usr/local/share/vocalinux/models unconditionally and crashed with
ValueError on Arch hosts when a custom XDG_DATA_DIRS never added
that path. Add regression tests, and make the lock-file test assert
the actual $XDG_DATA_HOME/vocalinux contract instead of the
hardcoded ~/.local/share default.

* fix(tests): keep the IBus engine double a plain class

Python 3.14's unittest.mock re-instantiates a user subclass when it builds
child mocks (klass(name=...)). VocalinuxEngine inherits from whatever
IBus.Engine resolves to, and the test module bound that to the MagicMock
class itself, so every engine instantiation raised

    TypeError: VocalinuxEngine.__init__() got an unexpected keyword argument 'name'

on 3.14 while passing on 3.13. Replace it with a plain stand-in class that
still hands out per-instance MagicMocks for the IBus API surface the engine
touches.

The same pattern remains in test_ibus_engine.py, test_ibus_engine_utils.py,
test_ibus_active_engine_guard.py and test_ibus_xkb_wayland.py; those never
instantiate the engine, so they are unaffected for now.

* fix(install): build the venv from the system Python

install.sh looked up a bare `python3` from PATH. Started from an activated
virtualenv — a shell left in uv's .venv after `just deps` — it built venv/
from that interpreter, where distro PyGObject is invisible even with
--system-site-packages, and the run aborted with

    Distro PyGObject (python3-gi / python3-gobject) is not importable in the venv.

A mismatched venv/ then survived every retry, because the installer reuses
whatever venv it finds.

- drop an inherited VIRTUAL_ENV (and its bin from PATH) before any
  interpreter lookup
- select the interpreter explicitly: $SYSTEM_PYTHON (default
  /usr/bin/python3) or PATH python3, preferring one that can import gi,
  and create the venv with it instead of `python3`
- recreate venv/ when it was built by a different interpreter
- name the interpreter in the PyGObject guard's error

Documents the two environments (uv's .venv for tooling, venv/ for the
installed app) in CONTRIBUTING, the justfile header and AGENTS.md, and adds
the mismatch symptom to the INSTALL troubleshooting section.

* chore(python): raise the supported floor to 3.11

requires-python promised 3.9 while the CI matrix ran 3.9/3.10/3.11/3.13,
the classifiers advertised up to 3.14, mypy targeted 3.12 and install.sh
enforced 3.9 — five different answers to "which Python does this support".

Settle on 3.11 everywhere: pyproject (requires-python, classifiers, black
targets), install.sh's MIN_VERSION, check-system-deps.sh, the distro package
map, the CI matrix (now 3.11-3.14, matching the classifiers), the release and
nightly workflows, and the docs.

mypy now targets the floor instead of 3.12, so type checking covers what we
promise; numpy 2.x ships stubs in 3.12 syntax that a 3.11 target cannot
parse, so its imports are skipped. (mypy has 71 pre-existing errors either
way; no CI job gates on it.)

uv.lock and the requirements/* exports are regenerated — dropping 3.9/3.10
removes most of the version-conditional resolution branches.

tests/test_python_version_policy.py pins the invariant: install.sh's floor,
requires-python, the classifiers and the CI matrix must agree.

* ci: run lint and tests from uv.lock

The lock file and the hash-pinned exports were not enforced anywhere: CI
still built a venv by hand and installed unpinned `PyGObject` plus
`-e ".[dev,vad]"`, so the tool versions it checked against had nothing to do
with the ones `just lint` uses locally.

Both Python jobs now use astral-sh/setup-uv and run through `uv sync
--locked` / `uv run --locked`, which also fails the build when uv.lock drifts
from pyproject.toml.

Partially covers phase 5 of #701 (tests install from the lock, lock freshness
gate); trusted publishing, artifact checksums and action SHA pinning are
still open there.

* ci: lint from a dedicated dependency group

The lint job failed on this branch: `uv run --extra dev` syncs the whole
project, so it tried to build pyaudio from source on a runner that installs
no system dependencies.

    src/pyaudio/device_api.c:9:10: fatal error: portaudio.h: No such file or directory

Move black/isort/flake8 out of the `dev` extra into a `lint` dependency
group. CI runs `uv run --locked --only-group lint`, which installs the three
pure-Python tools and skips the project entirely — no portaudio or
girepository headers needed. `just deps` and DEV_EXTRAS request the group
alongside the dev extras, so the local environment still carries test and
lint tooling at once and `just lint` matches CI version for version.

pre-commit is unaffected: its hooks pin their own tool versions upstream.

* fix(install): never configure an engine the venv cannot import

vosk became an optional extra in #705, but the installer still writes
`"engine": "vosk"` into config.json on the whisper.cpp fallback path even
when installing the extra only produced a warning. config.json also survives
reinstalls — every writer guards on "file does not exist" — so an engine
picked by an earlier attempt outlives the venv that supported it. Either way
Vocalinux dies at startup:

    ModuleNotFoundError: No module named 'vosk'

- the fallback now writes the vosk config only when `import vosk` actually
  succeeds, and otherwise leaves the engine configuration alone
- a new verify_configured_engine() runs near the end of the install: if
  config.json selects vosk and the venv cannot import it, it says so and
  prints both fixes instead of leaving a broken install behind

* feat(models): verify every model download against a pinned digest

Pins a sha256/md5 per downloadable speech model in
src/vocalinux/utils/model_checksums.txt and verifies against it in both
install.sh and the runtime downloaders, before the file is moved into place.
Verification fails closed. Covers phase 2.5 of #701; see the PR for details.

* docs(agents): rebase AGENTS.md onto the #727 rewrite

* fix(install): hash models that are already on disk instead of trusting them

* refactor(models): one download path per engine, and fix Whisper's

* docs(install): drop distros that cannot meet the 3.11 floor

* docs: retire the distros and Python versions the 3.11 floor rules out

* fix(install): abort instead of warning when Python is below the floor

* fix(install): fall back to the system Python, not the one on PATH

* fix(install): match an existing venv by installation, not by X.Y

* fix(install): repair a config naming an engine the venv cannot import

* fix(models): pin VOSK by the sha256 of bytes we fetched, not upstream's md5

* fix(justfile): request the dev set in every recipe that syncs

* test(version): scan the docs and website trees for a stale Python floor

* docs: correct the stale model-checksum and distro claims

* fix(models): stamp the VOSK tree the app extracts, as the installer does

* fix(install): replace an unverified VOSK model only once its successor is ready

* docs(install): align the Fedora floor with the rest of the tree

* test(install): drop an f-string with no placeholders

* test(models): stub the downloader probe the VOSK installer test relies on

* docs: drop the long dashes from two model-checksum comments

* fix(install): gate on the interpreter, not on the distro release label

* fix(justfile): export the lint group into requirements/dev.txt

* fix(models): unpack the VOSK tree into staging and stamp it before the swap

* fix(whisper): adopt a checkpoint an earlier release stored under the catalog name

* docs(settings): state what a stray Whisper copy really means for deletion

* fix(models): hash a whisper.cpp model found on disk before it reaches ctypes

* docs(contributing): stop telling readers to uninstall their linters

* fix(install): stop warning off distros the project documents as supported

* docs(distros): file the supported derivatives under supported

docs/DISTRO_COMPATIBILITY.md

@@ -44,15 +44,24 @@ The `.desktop` entry is automatically configured with the detected `GI_TYPELIB_P
 
 ## Officially Supported Distributions
 
-These distributions are tested and known to work well with Vocalinux:
+These distributions are tested and known to work well with Vocalinux. A
+derivative is judged by the Python it ships rather than by its own version
+number, which rarely tracks the base release, and `install.sh` checks the
+interpreter rather than the release label.
 
 | Distribution | Version | Status | Notes |
 |--------------|---------|--------|-------|
-| Ubuntu | 22.04+ | ✅ Full Support | Primary target, most thoroughly tested |
-| Debian | 11+, Testing | ✅ Full Support | Well tested, use Ayatana AppIndicator on Debian 11+ |
+| Ubuntu | 24.04+ | ✅ Full Support | 22.04 ships Python 3.10, below the 3.11 floor |
+| Debian | 12+, Testing | ✅ Full Support | Primary target; use Ayatana AppIndicator |
 | Fedora | 39+ | ✅ Good Support | Uses lib64 paths, fully supported |
 | Arch Linux | Rolling | ✅ Good Support | Community tested, rolling release compatible |
 | openSUSE | Tumbleweed | ✅ Good Support | Good support with zypper package manager |
+| Linux Mint | On Ubuntu 24.04+ | ✅ Good Support | Mint 22 qualifies; Mint 21 is on Ubuntu 22.04, below the floor |
+| Pop!_OS | 24.04+ | ✅ Good Support | Uses Ubuntu's own numbering |
+| elementary OS | On Ubuntu 24.04+ | ✅ Good Support | elementary 8 qualifies; 7 is on Ubuntu 22.04 |
+| Zorin OS | On Ubuntu 24.04+ | ✅ Good Support | Zorin 17 is on Ubuntu 22.04, below the floor |
+| Manjaro | Rolling | ✅ Good Support | Arch base, inherits Arch compatibility |
+| EndeavourOS | Rolling | ✅ Good Support | Arch base, inherits Arch compatibility |
 
 ## Experimental Support
 
@@ -65,12 +74,6 @@ These distributions may work but have known limitations or are less tested:
 | Void Linux | ⚠️ Experimental | Untested, manual install required. Uses xbps package manager. |
 | Solus | ⚠️ Experimental | Untested, manual install required. Uses eopkg package manager. |
 | Mageia | ⚠️ Experimental | Untested, uses dnf/urpmi package managers. |
-| Linux Mint | ✅ Good Support | Based on Ubuntu, inherits Ubuntu compatibility |
-| Pop!_OS | ✅ Good Support | Based on Ubuntu, inherits Ubuntu compatibility |
-| elementary OS | ✅ Good Support | Based on Ubuntu, inherits Ubuntu compatibility |
-| Zorin OS | ✅ Good Support | Based on Ubuntu, inherits Ubuntu compatibility |
-| Manjaro | ✅ Good Support | Based on Arch, inherits Arch compatibility |
-| EndeavourOS | ✅ Good Support | Based on Arch, inherits Arch compatibility |
 
 ## Not Supported
 
@@ -88,7 +91,7 @@ sudo apt install -y python3-gi gir1.2-gtk-3.0 gir1.2-gdkpixbuf-2.0 \
   portaudio19-dev python3-dev python3-venv pkg-config
 ```
 
-**Note for Debian 11+:** Use `gir1.2-ayatanaappindicator3-0.1` instead of `gir1.2-appindicator3-0.1`
+**Note for Debian 12+:** Use `gir1.2-ayatanaappindicator3-0.1` instead of `gir1.2-appindicator3-0.1`
 
 ### Debian-specific notes
 
@@ -174,7 +177,7 @@ native dependencies; it does **not** mean beta or unstable packages. If
 ### Gentoo
 ```bash
 sudo emerge dev-python/pygobject:3 x11-libs/gtk+:3 dev-libs/libayatana-appindicator \
-  media-libs/portaudio dev-lang/python:3.9
+  media-libs/portaudio dev-lang/python:3.11
 ```
 
 **Note:** Gentoo compiles packages from source, which will take longer.

docs/INSTALL.md

@@ -136,13 +136,24 @@ On Ubuntu 24.04+ or Pop!_OS, install `libgirepository-2.0-dev` if
 
 | Requirement | Details |
 |-------------|---------|
-| **Operating System** | Ubuntu 22.04+ (recommended), Debian 11+, Fedora 38+, Arch Linux |
-| **Python** | 3.9 or newer |
+| **Operating System** | Debian 12+, Ubuntu 24.04+, Fedora 39+, Arch Linux |
+| **Python** | 3.11 or newer |
 | **Display Server** | X11 or Wayland |
 | **Hardware** | Microphone for speech input |
 | **Disk Space** | ~200MB (including whisper.cpp model) |
 | **RAM** | 4GB minimum, works great with 8GB |
 
+The distribution has to ship Python 3.11 or newer, because Vocalinux uses the
+distro's own PyGObject (`python3-gi`), which is built for that interpreter and
+no other. That rules out Ubuntu 22.04 (Python 3.10) and Debian 11 (3.9): a 3.11
+virtualenv on them cannot import the distro `gi`, and their `python3` is below
+the floor.
+
+Derivatives are judged by the interpreter they ship, not by their own version
+number, which rarely tracks the base release. Linux Mint 22 and elementary OS 8
+are built on Ubuntu 24.04 and qualify; Linux Mint 21 and Zorin OS 17 sit on
+Ubuntu 22.04 and do not.
+
 ### GPU Support (Optional)
 
 **whisper.cpp** supports GPU acceleration via **Vulkan**, which works with:
@@ -332,7 +343,7 @@ sudo apt install -y xdotool
 sudo apt install -y wtype wl-clipboard xclip xsel
 ```
 
-**Debian 11/12:**
+**Debian 12+:**
 ```bash
 sudo apt update
 sudo apt install -y \
@@ -412,9 +423,14 @@ is unavailable on your snapshot, try `${PYVER}-venv`.
 
 ### 2. Create Virtual Environment
 
+Use the **system** Python: PyGObject (`gi`) comes from your distro package and is
+compiled for that interpreter only, so a venv created from pyenv/conda/uv Python
+cannot import it even with `--system-site-packages`. Deactivate any active
+virtualenv first.
+
 ```bash
 cd vocalinux
-python3 -m venv venv --system-site-packages
+/usr/bin/python3 -m venv venv --system-site-packages
 source venv/bin/activate
 pip install --upgrade pip setuptools wheel
 ```
@@ -586,15 +602,34 @@ sudo apt install python3-gi python3-gi-cairo
 # For appindicator (system tray icon) - try one of these:
 sudo apt install gir1.2-appindicator3-0.1  # For older Debian/Ubuntu
 # OR
-sudo apt install gir1.2-ayatanaappindicator3-0.1  # For Debian 11+ or newer Ubuntu
+sudo apt install gir1.2-ayatanaappindicator3-0.1  # For Debian 12+ or newer Ubuntu
 
-# Recreate venv with system packages
+# Recreate venv with system packages, from the system Python
+deactivate 2>/dev/null || true
 rm -rf venv
-python3 -m venv venv --system-site-packages
+/usr/bin/python3 -m venv venv --system-site-packages
 source venv/bin/activate
 pip install -e .
 ```
 
+**Symptom:** the installer stops with "Distro PyGObject (python3-gi /
+python3-gobject) is not importable in the venv"
+
+The distro package is installed, but `venv/` was built by a different Python than
+the one it targets (a pyenv/conda/uv interpreter, or a virtualenv that was active
+when you started the installer). Current versions of `install.sh` detect and fix
+this on their own — ignoring an activated virtualenv and rebuilding a mismatched
+`venv/`. Otherwise:
+
+```bash
+deactivate 2>/dev/null || true
+rm -rf venv
+./install.sh
+```
+
+On systems shipping several system interpreters, point the installer at the one
+your distro built `gi` for: `SYSTEM_PYTHON=/usr/bin/python3.12 ./install.sh`.
+
 ### Text Injection Not Working
 
 **Symptom:** Recognized text doesn't appear in applications