Recover saved meetings stuck in speaker review

[r3dbars]

Fixes #1681.

Supersedes #1693. That draft allowed same-ID request and stale-finalizer races; this branch replaces it with exact review-owner fencing.

What failed

The sanitized evidence proves the meeting Markdown, retained system audio, and speaker clips were saved before speaker-naming finalization failed to resolve stable ID 13D4DF54-AEC5-434D-8E44-C375E2F87473. It does not prove the exact filesystem trigger because the sanitized Markdown is shorter than the historical UTF-8 prefix boundary. The deterministic reproduction therefore reconstructs the stale expected-path / renamed canonical transcript condition with the evidence ID and a UTF-8 boundary case.

Recovery

• Re-transcription stays available when the pending speaker review belongs to that exact saved meeting.
• The matching transcript is resolved by stable frontmatter identity, never filename, display name, or newest-file fallback.
• Retained audio and the old speaker review stay intact through model preparation, audio validation, and transcript reservation.
• Recovery revokes only the exact captured review request. A newer same-ID review or unrelated review wins and blocks the stale recovery attempt.
• Superseded finalizers cannot rewrite the replacement transcript, mutate speaker identity, publish stale retry/failure state, or clear a fresh review.
• Transcript finalization and replacement share the stable-ID reservation barrier.

Automated proof on 4ad639c9

Green:

• bash build-deps.sh --force
• bash build.sh --no-open — signed app, 1305.9 ms launch smoke
• bash run-integration-smoke.sh
• swift test — full TranscriptedCore package suite passed
• focused package recovery regressions, including stale-path resolution, exact-owner supersession, stale finalizer isolation, retained audio, and short-audio rejection
• bash run-tests.sh --filter RecentCaptureScanners — 134/134
• codex review --base origin/main — clean after fixing both reported races

Not green:

• bash run-tests.sh completed with 12,190/12,195, five failures. Re-running the binary/wrapper to isolate names aborts or exits before printing failure lines. The changed RecentCapture suite passes alone. This is still a red required gate until the five failures are identified; do not merge on this receipt alone.

Manual proof still required

Automated tests do not prove the real 94-minute system-only import, installed-app UI state, retained-audio discovery, or live speaker-sample playback.

Before merge, dogfood an affected or disposable retained-audio meeting and verify:

1. Speaker samples are disabled/pending while re-transcription is enabled only for the matching meeting.
2. Starting recovery preserves the old review until the replacement actually owns the transcript.
3. Short/missing/corrupt audio leaves the original review, sample clips, Markdown, and retained audio intact.
4. Successful recovery produces one Markdown row with the same stable ID, preserves retained audio, and creates playable fresh samples.
5. Naming/saving writes the correct speaker identities without a duplicate meeting.
6. An old review completion racing replacement cannot overwrite the new transcript or speaker database.

This PR is draft because the full fast-test gate and live affected-artifact proof remain open.