v0.3.6 — Fix audio local-copy that created a literal $HOME directory

Web-UI-driven local audio transcribe jobs were silently failing because their input file was being copied to a real on-disk $HOME directory instead of the intended $workdir/audio-in/. Whisper then read from the empty audio-in/ and exited with "Error opening input file ~/.spectator/audio-in/".

audio.transcribe()'s local-mode upload was passing the bash-friendly form of the path ($HOME/.spectator/audio-in) through os.path.expanduser, which only handles ~ — not $HOME. The literal $HOME token then became a directory name under the subprocess cwd.

Fix: route cfg.workdir through pathlib.Path.expanduser() directly. New regression test (test_audio_local_copy_resolves_workdir_correctly) pins the local-copy destination to <workdir>/audio-in/<basename> and asserts no literal $HOME directory leaks. 47/47 tests pass.

Affects: any ./spectator audio transcribe invocation without --target (i.e. running on the local machine), including all Web-UI-submitted audio jobs when the Web UI is hosted on the same machine the work runs on.

Migration: none — upgrade in place.