fix: support Ubuntu 26.04 install and Qt timers

[TimInTech]

What changed

• bind HistoryPanel and HistoryEntryWidget reset timers to their Qt owners instead of using context-free QTimer.singleShot callbacks
• add a regression test that destroys the owning C++ widgets before short real timer deadlines elapse
• correct installer/autostart guidance and document the verified Ubuntu 26.04 GNOME/Wayland native-install path
• clarify that the AI-workflow setting stores only an API-key environment variable name; the secret itself belongs only in ~/.config/blitztext-linux/secrets.env
• run the complete CI workflow on Python 3.11, 3.12, and 3.14

Why

PyQt 6.11 with Python 3.14 exposed a lifetime bug: a static timer callback could run after deleteLater() had destroyed the C++ widget, aborting the Python process. Owner-bound QTimer instances are destroyed with their widgets and prevent the stale callback.

The install guidance also described systemctl --user start as enabling autostart even though the installer already enables the user service. Ubuntu 26.04 ships Python 3.14, so that verified runtime now needs equal CI coverage.

Validation

• python3 -m compileall app tests
• QT_QPA_PLATFORM=offscreen WHISPER_GUI_TESTS=1 .venv/bin/python -m pytest -q — 524 passed, 2 skipped on Python 3.14.4
• tests/test_state_machine.py — 30 passed
• focused installer/verify tests — 14 passed
• bash -n scripts/install.sh scripts/verify.sh
• git diff --check
• repository secret hygiene scan
• Ubuntu 26.04 GNOME/Wayland live verification — 18 PASS, 0 FAIL, 0 WARN, including recording, local Whisper, global hotkey, clipboard, auto-paste, tray, and autostart

Flatpak remains an experimental developer spike and is unchanged. PR #54 is handled separately after this PR.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c7989dbf46

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Stop the manual instance before starting the service

When the ./run.sh test from step 2 is still running, this command starts a second application instance because the systemd unit executes Python directly and therefore bypasses run.sh's PID-file guard. Both instances then consume the same evdev hotkeys, potentially recording and pasting twice. Instruct users to quit the manual instance before this step, or make both launch paths share the same single-instance guard.

Useful? React with 👍 / 👎.