fix(desktop): recover recording end from durable capture evidence

[Git-on-my-level]

A short recording recovered four days after a crash previously uploaded restart time as finished_at, creating a multi-day capture interval. Crash recovery now preserves a valid persisted end or derives the end from the maximum valid durable segment end in the finish transaction. Normal stops retain their existing behavior, legitimate long recordings are not capped, and the existing one-second minimum keeps subsecond captures valid in the whole-second upload format.

Rows without valid timing evidence remain intact outside the upload queue; the launch sweep still deletes empty rows. This does not repair previously uploaded records.

Failure-Class: new

Adds FC-recovery-time-used-as-event-time. Product invariants: none required by scripts/pr-preflight --suggest.

Root cause: the shared finish transition confused recovery time with capture time. The durable guard executes production persistence against an isolated database and inspects the real finalizer's encoded request using a URLProtocol stub. This is a fix to the shared persistence primitive, not a new source-pattern guard. The RCA is the interrupted-recording path on origin/main cb321fe; attribution of the six reported rows remains unproven.

Validation:

• xcrun swift test --package-path Desktop --filter TranscriptionStorageRecoveryTests (from desktop/macos): 20 tests, including delayed/repeated recovery, persisted/invalid ends, unordered/invalid segments, no evidence, normal stops, long recordings, and subsecond evidence.

• xcrun swift test --package-path Desktop --skip-build --filter ConversationFinalizationLocalProjectionTests: 8 tests; the new regression drives launch recovery and checks the encoded upload through a hermetic URLProtocol transport.

• Neighboring TranscriptionFinalizationStateMachineTests: 25 tests; TranscriptionSessionRecordTests|TranscriptionRetryResilienceTests: 13 tests.

• Negative control: temporarily restoring the original finish assignment makes the new launch-to-upload regression fail (six assertions, including the inflated finished_at). Restored the fix and reran the touched suites.

• OMI_PR_BODY_FILE=/tmp/omi-duration-pr-body.md make preflight: all 26 selected checks passed at the committed head (including pinned Swift formatting and SwiftLint).

• scripts/failure-class validate --pr-body-file /tmp/omi-duration-pr-body.md: passed.

• scripts/pr-preflight --pr-body-file /tmp/omi-duration-pr-body.md: all 26 checks passed at the committed head.

• Normal pre-push gate passed, including xcrun swift build -c debug; no bypasses.

Backend Hermetic Merge Gate: out of scope; no backend changes.

Unproven: live signed-app crash/restart, deployed behavior, the six reported records and their empty transcripts, and historical data repair.