chore: Validate Whisper model downloads and binding compatibility

## What
Add validation around downloaded Whisper models and the `whisper-rs`/whisper.cpp binding boundary.

## Why
- `.planning/codebase/CONCERNS.md` calls out model and binding compatibility drift as a dependency risk.
- Downloaded model files are selected by name and expected size, but compatibility is only proven when loading/transcribing.
- Dependency updates can break model loading or inference behavior.

## How
- Validate model files with expected size and, if available, checksums.
- Add a small transcription smoke test fixture that runs only in an opt-in or CI-capable mode.
- Document known-good `whisper-rs` and model combinations.
- Treat Renovate Whisper updates as requiring the smoke test before merge.