Manage installed narration models and persisted opt-in

## Problem

Installed files, user opt-in, runtime compatibility, and update availability are distinct states; conflating them risks silent downloads, lost settings, or unsafe deletion.

## Proposed change

Add the shared model inventory/lifecycle and persistent preference service. Support not-installed, downloading, installed-disabled, enabled, incompatible/update-available, and recoverable error states. Default to disabled. Installation, enable/disable, explicit update, and removal remain separate intentions. Reuse application-data paths and atomic preference persistence. Define exclusive ownership and safe coordination of install/remove/update with active model use; frontend/session integration follows in Coordinate narration through the shared live session.

## Acceptance Criteria

- [ ] AC1: Lifecycle tests show installing does not silently enable narration, disabling retains files, and enabling requires a compatible verified installation.
- [ ] AC2: Restart and malformed-preference checks preserve valid user choices and fall back safely without implicit download or load.
- [ ] AC3: Compatibility tests detect unsupported/corrupt installations and available supported revisions without downloading updates automatically.
- [ ] AC4: Concurrent install/remove/update and active-use boundary tests enforce the #454 ownership policy without a half-installed usable model or access to removed files.
- [ ] AC5: Removal/reinstall checks delete only managed model data and leave ratings, images, other preferences, and core recommendation use intact.

## Implementation classification

- **Estimated size:** M
- **Orchestration risk:** High
- **Reason:** Persistent state, compatibility, and concurrent file lifecycle must remain consistent across restarts.

## Dependencies

Direct prerequisites: #457. Consumer: Coordinate narration through the shared live session.