feat: add registry-driven capability architecture

[tulayha]

Summary

• make dialogue, scene, and actor capability-owned folders with their own Pydantic config, schemas, operations, model preparation, indexing, and dependency manifests
• keep a small explicit registry for capability selection while making core runner and visual fan-out generic
• expose capability options and preparation through Typer without hardcoded model flags
• keep the Streamlit frontend on the shared service and index only capabilities selected from the installed extras
• split installs into storage, dialogue, scene, actor, all, frontend, and intentional benchmarks extras
• make requirement manifests the only runtime dependency declarations and declare shared Chroma storage once
• lazily mount benchmark commands only when the benchmark extra is installed
• add scoped PR validation, build-once publishing, and public-repository security workflows
• include the main-based semantic release, Towncrier, contributor guidance, and tagged release ancestry from feat: add CLI access layer and release foundation #11
• publish the exact Semantic Release distributions to GitHub and PyPI, with PyPI protected by its deployment environment
• build a non-root, CPU-default stable image with all capabilities and the frontend, but no downloaded model weights
• add environment-driven Compose storage and build, smoke, then publish the same stable image under exact, minor, and latest GHCR tags

Why

Adding a feature previously required coordinated edits across core dispatch,
storage, model checks, CLI wiring, and packaging. A contributor can now own a
capability inside one folder, register its contract once, and install only the
runtime surface they need. The same validated service contracts remain usable
by the CLI, current Streamlit frontend, and a future API or MCP access layer.

Install impact

• vidxp installs the application and Typer CLI boundary only
• vidxp[storage] installs the shared local vector store
• vidxp[dialogue], vidxp[scene], and vidxp[actor] install storage plus only the selected capability runtime
• vidxp[all] installs every runtime capability, but not the frontend or benchmarks
• vidxp[frontend] and vidxp[benchmarks] remain explicit add-ons
• docker compose up runs the all-capability frontend while a named volume persists repositories, indexes, and model caches
• stable images are CPU-only linux/amd64; model weights remain an explicit vidxp prepare download
• indexes created with an older schema must be rebuilt

Validation

• ruff check src tests
• python -m unittest discover -s tests -q (134 tests)
• actionlint across every workflow
• Towncrier draft contains one user-facing fragment for feat: add CLI access layer and release foundation #11 and one for feat: add registry-driven capability architecture #12
• clean sdist and wheel build after synchronizing feat: add CLI access layer and release foundation #11
• isolated minimal-wheel installation and dependency check
• verified the minimal CLI does not import or install Chroma, Torch, WhisperX, OpenCV, face-recognition, Streamlit, or benchmark dependencies
• isolated benchmark-extra install and command discovery
• Streamlit AppTest coverage plus real headless UI health checks
• built the final image locally and verified CPU-only Torch, all capability imports, non-root execution, no compiler toolchain, no bundled model caches, and vidxp doctor
• recreated the Compose service and verified writable storage persisted across containers
• Gitleaks scan across repository history: no leaks
• pip-audit: no known vulnerabilities in the base, frontend, or benchmark surfaces
• GitHub CodeQL advanced workflow completed successfully

README reconciliation

The origin/main logo, centered title and tagline, recommended-specs
placeholder, contribution invitation, and credits are preserved. The redundant
centered interface list and assetless desktop-download CTA were removed; the
header now shows verified package and project-status badges. Quick Start uses
pipx for an isolated command on PATH, while library, source, development,
and container setup remain in the installation guide. Other README changes
remain limited to the current capabilities, extras, canonical commands,
repository configuration, capability import, and contribution links.

Security notes

The current Chroma release is reported against CVE-2026-45829 and has no patched
release. The advisory concerns Chroma's unauthenticated FastAPI server; VidXP
creates an embedded PersistentClient and does not launch that server. A tested
downgrade to pre-1.0 Chroma was rejected because it leaked database handles on
Windows. The dialogue stack also inherits Torch and Transformers advisories
whose fixed versions conflict with the current WhisperX and
sentence-transformers constraints. Dependabot security updates, dependency
review, secret scanning, push protection, CodeQL, and private vulnerability
reporting are enabled so compatible upstream fixes can be adopted safely.

Pull request relationship

This PR contains and supersedes #11 so the release foundation and capability
architecture can land together without an intermediate release branch merge.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.