feat: integrate Google semantic search and branded desktop launcher

crates/searchi-assets/README.md

@@ -0,0 +1,52 @@
+# Searchi assets
+
+GUI-free model provisioning shared by desktop setup and headless CLI setup.
+Search never invokes this downloader automatically. Inference and GPU providers
+are outside this crate; provisioning tests run on the Windows VM using CPU only.
+
+The compiled [model manifest](../../tools/embeddinggemma2/model-manifest.json)
+pins Google EmbeddingGemma 2's text GGUF and multimedia projection to one
+Hugging Face export commit, exact byte lengths, and SHA-256 digests. The two
+artifacts total 864,676,480 bytes. Source URLs cannot be overridden through the
+public API. Executable embedding workers remain bundled release resources and
+are never downloaded by this crate.
+
+```rust,no_run
+use std::sync::atomic::AtomicU64;
+let directory = searchi_assets::default_model_directory()?;
+let progress = AtomicU64::new(0);
+if !searchi_assets::verify_cached(&directory)? {
+    // Only after the user explicitly chooses setup/download.
+    searchi_assets::provision(&directory, &progress)?;
+}
+# Ok::<(), anyhow::Error>(())
+```
+
+- `default_model_directory()` computes the platform-local application data path
+  via `directories::ProjectDirs`, then appends `models/embeddinggemma2`.
+- `verify_cached(directory)` performs offline size and full-digest validation.
+  It does not trust a same-size file or create directories.
+- `provision(directory, progress)` verifies/reuses cached artifacts and downloads
+  only missing or corrupt files. Call it on a blocking setup worker.
+- `TOTAL_BYTES` supplies the progress total to GUI and CLI consumers.
+
+New files are streamed through a 64 KiB buffer and rejected immediately if the
+body exceeds the pinned size. Content-Length, when supplied, must also match.
+The final byte count and SHA-256 must match before the temporary file is synced
+and atomically replaces the destination in the same directory. A failed attempt
+leaves any existing destination intact and deletes its temporary file through
+RAII. Unix directory metadata is also synced after replacement.
+
+There are three attempts per artifact, with 250/500 ms retry delays. Connections
+time out after 20 seconds, and an entire request including streamed body reads
+after 900 seconds. Progress includes completed verified artifacts and the current
+attempt's received bytes; it resets to completed verified bytes after failure.
+Hard process termination can leave orphan `.part` files, which are never treated
+as valid models. Downloads resume by reusing completed verified artifacts rather
+than trusting partial files.
+
+Tests use a private local HTTP fixture and small authentic byte payloads; they
+do not download the production model or rely on a public service. They verify
+same-size corruption, cache reuse without URL requests, interrupted-response
+retry, streaming size bounds, incorrect digests, atomic replacement, and partial
+file cleanup. Linux/macOS runtime checks remain pending.