feat(identity): rename user-visible identity to voculinux with one-time legacy import

The fork takes its own name everywhere a user can see it: binaries
(voculinux, voculinux-gui), desktop entry, autostart, tray, D-Bus
namespace (com.voculinux.Voculinux, no alias for the old name),
config/data/cache dirs, single-instance lock, IBus engine identity,
tray icons, resource prefixes, VOCULINUX_* environment names, and the
update-checker user agent. The internal Python module stays vocalinux
and the distribution metadata keeps the upstream URLs as provenance.

On first run a previous Vocalinux install's config.json, custom
dictionary, and portal restore token are copied once into the new
locations (new config always wins, no merge, no write-back); models
re-resolve through the pinned-checksum download path. An offline
naming-sweep test proves no old-name strings remain on user-visible
surfaces outside the allowlist.

Refs #18

docs/SNAP.md

@@ -30,7 +30,7 @@ packages over incidental copies in the GNOME platform.
 
 The build audits build-tool and installed runtime versions against the active
 export pins and records expected runtime versions and both export digests in
-`usr/share/vocalinux/python-inputs.json` inside the snap. Missing or wrong-version
+`usr/share/voculinux/python-inputs.json` inside the snap. Missing or wrong-version
 build tools fail the build. For the packaged runtime, extra and duplicate
 Python distributions are rejected as well.
 
@@ -49,15 +49,15 @@ snapcraft pack
 On a **disposable Ubuntu host with snapd**, inspect the resulting artifact:
 
 ```bash
-bash snap/local/smoke-test.sh ./vocalinux_<version>_amd64.snap
+bash snap/local/smoke-test.sh ./voculinux_<version>_amd64.snap
 ```
 
 Replace `<version>` with the version that was built. The script refuses to overwrite an
-existing Vocalinux snap. It installs the supplied file with `--dangerous`,
+existing Voculinux snap. It installs the supplied file with `--dangerous`,
 runs the actual application launcher with `--version`, then enters the GNOME
 command-chain environment to audit Python versions and import the native,
 GTK, recognition and text-injection modules. It leaves the installation in
-place for inspection; use a disposable host, not your normal Vocalinux install.
+place for inspection; use a disposable host, not your normal Voculinux install.
 
 `unified-pipeline.yml` builds and runs this gate on relevant Python/Snap PRs and
 main pushes, including recipe-only changes. `release.yml` runs it before the