v0.6.1 CSP model-download hotfix

v0.6.1 CSP model-download hotfix

v0.6.1 is a patch hotfix over v0.6.0. It preserves the task-first v0.6 UI release and fixes production model installation by allowing the committed public Hugging Face model-download origin in Content Security Policy.

Changes

• Adds the exact committed model-file origin https://huggingface.co to Vercel connect-src.
• Keeps direct-route SPA fallback and existing COOP/COEP/Permissions-Policy/security headers intact.
• Adds static Vercel tests that derive installable model origins from committed manifests and reject wildcard or broad CSP sources.
• Documents the CSP troubleshooting pattern for model downloads.

Unchanged from v0.6.0

• No UI, model-pack, profile, adapter, portable-bundle, storage, training, or privacy schema contract changes beyond the deployment CSP header.
• No telemetry, analytics, remote logging, account service, or broad third-party network allowance was added.
• v0.6.0 release artifacts and tag remain immutable.

Known limitations

• Issue #255 remains open for final moderated release-usability participant evidence.
• Production accuracy and reference-hardware performance evidence limitations from ADR 0004 and ADR 0005 remain unresolved.
• Manual Windows NVDA/Edge and macOS VoiceOver/Safari accessibility matrix rows remain accepted limitations until run outside the Linux agent environment.

Assets

• speech-web-v0.6.1-dist.tar.gz — built web distribution for the tagged commit.
• SHA256SUMS.txt — checksum for the web distribution archive.