[K2][OS-05] Desktop, speech and inference OS ports

Programme: #1
Epic: #34

## Objective
Port the real user-space personal runtime workloads onto the Rust-kernel substrate so kernel progress is measured by actual UI, speech, file and local-inference operation rather than boot demos alone.

## Scope
- Graphics/display/compositor path sufficient for trusted shell/application surfaces.
- Keyboard/pointer/touch input stack and accessibility-facing primitives needed by the desktop runtime.
- Audio input/output path for local speech and read-aloud.
- Storage/filesystem services and content-addressed artifact store compatibility.
- Networking required by browser/connectors with explicit privilege separation.
- Port/adapt supervisor, local IPC, workspace state store and core Rust user-space services.
- Local inference runtime/toolchain support with CPU fallback first and accelerator path measured separately.
- Local speech runtime support using the same product contracts as desktop releases.
- Resource scheduling/telemetry for UI, browser, speech and inference competition.

## Architecture rules
- Reuse product contracts; do not fork a kernel-specific task/workspace/memory model.
- GPU/accelerator work is measured independently from CPU functionality and may remain limited in early K2.
- Failure of speech/inference must not destabilize the desktop/session service.

## Acceptance criteria
- [ ] Trusted shell renders and handles normal keyboard/pointer interaction on the K2 target.
- [ ] Workspace/state/artifact operations run through the same logical contracts used by the desktop application.
- [ ] Local speech captures/transcribes an offline test corpus on target hardware/VM configuration.
- [ ] At least one supported local inference workload runs with measured latency/resource use; CPU fallback is documented.
- [ ] Networked browser/connector worker can operate without gaining kernel privilege.
- [ ] Model/speech/browser worker crashes remain isolated from login/files/core session recovery.

## Dependencies
- OS-04
- LOCAL-01
- VOICE-01

**First phase:** K2
**Maturity target:** K2
**Owner:** os-systems

No files or tests are named. Start by reviewing the OS-04, LOCAL-01, and VOICE-01 dependencies and the existing product contracts, then map the first K2 target path against the acceptance criteria. Done means the trusted desktop, offline speech, CPU-fallback inference, isolated networking, and crash-recovery checks pass on the target configuration.

Written by the indexing model from the issue text.