chore: non-interactive release model download, fail-closed make targets, CI quality job, docs sync

[m-szymanska]

PR type: devex / release / docs

Problems addressed

From the same verified quality recon as #55:

1. [P1, CONFIRMED] Release DMG CI died on an interactive prompt. scripts/download-model.sh (and its twin download-embedder.sh) ran read -p under set -euo pipefail; on a cold CI runner with no TTY the read hits EOF and the release job exits before xcodebuild even starts.
2. [P2] Five Makefile test targets were fail-open. test-e2e, test-e2e-real, test-formatting, test-all, test-sse piped cargo test | tee without PIPESTATUS and ended the recipe with echo — the target exited 0 even with failing tests. make check additionally masked prettier failures with || true.
3. [P2] CI ran no clippy and no tests. The quality job in rust.yml was commented out; only cargo fmt gated PRs.
4. [P2/P3] Public-repo docs drift. examples/README.md documented two non-existent examples, omitted all 8 real ones and claimed Rust 1.70+ (workspace needs 1.85+/edition 2024); NOTICE used non-brand CodeScribe casing; CHANGELOG.md was missing entries for merged PRs feat(settings): API key liveness probe in Keys panel #50–fix(onboarding): open Settings via SwiftUI openSettings action #54.
5. A pre-existing semgrep false positive (actix path-traversal taint rule on a bench manifest helper in test code) started blocking every push after a semgrep update — suppressed inline with justification.

Fixes

• scripts/download-model.sh, scripts/download-embedder.sh: CI=true or no TTY → no prompt; clear non-interactive message (with HF_TOKEN hint) then normal download. Interactive TTY behavior unchanged. release.yml needs no token: both default models verified public (gated: False).
• Makefile: the exact set -o pipefail + PIPESTATUS[0] pattern already used by test/test-quick applied to all five targets (both cargo test invocations inside test-sse); prettier || true removed from check.
• .github/workflows/rust.yml: quality job (clippy -D warnings + cargo test --workspace with CODESCRIBE_DISABLE_KEYCHAIN=1) re-enabled on the same self-hosted/toolchain pins as the existing format job; #[ignore] tests (real API/audio/models) stay excluded, documented in a workflow comment; no continue-on-error.
• examples/README.md, NOTICE, CHANGELOG.md: synced to reality (all 8 examples documented and verified compiling via cargo check --examples; brand casing fixed; changelog caught up).
• core/pipeline/streaming/tests.rs: one-line justified nosemgrep suppression.

Test plan (commands actually run)

bash -n scripts/download-model.sh scripts/download-embedder.sh   # clean
shellcheck scripts/download-model.sh scripts/download-embedder.sh # clean (0.11.0)
</dev/null CI=true bash scripts/download-model.sh ...            # deterministic, no hang, exit 0 (3 probes)
PATH=/tmp/fakebin:$PATH make test-e2e        # fake failing cargo -> exit != 0
PATH=/tmp/fakebin:$PATH make test-formatting # fake failing cargo -> exit != 0
make test-sse                                # real cargo -> green
cargo clippy --workspace --all-targets -- -D warnings   # exit 0
CODESCRIBE_DISABLE_KEYCHAIN=1 cargo test --workspace    # exit 0
actionlint .github/workflows/rust.yml                   # exit 0
semgrep scan --config auto --error core/pipeline/streaming/tests.rs  # 0 blocking

Smoke notes

• First quality CI run on this PR is the live verification of the re-enabled job — if it sits in queued, that is runner-group config (allows_public_repositories), not the workflow.
• make release-dmgs on a cold checkout without models now either downloads or fails fast with a clear message — no interactive hang.

Out of scope / backlog

Model source default, bench reproducibility (bench-stt.sh private-corpus preference), remaining P3 docs items — recorded in the recon backlog.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[gemini-code-assist]

Code Review

This pull request updates the project's testing and build configuration, documentation, and download scripts. Key changes include updating the Makefile to use set -o pipefail and capture PIPESTATUS to ensure test failures are not masked by piping to tee, and removing || true from the Prettier formatting check to enforce formatting compliance. Additionally, the HuggingFace model and embedder download scripts were updated to support non-interactive execution in CI environments, the examples documentation was expanded to cover new demo files, and a semgrep warning bypass was added to a benchmark test helper. No review comments were provided, so there is no feedback to address.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.