phase 5: windows build + macos/windows on-hardware verification

[boxerab]

Linux is fully supported (CI + release bundles). macOS now builds green in CI and
produces release bundles too, after fixing a Cargo.toml bug where serde/anyhow/etc.
were scoped Linux-only (they sat under [target.'cfg(target_os = "linux")'.dependencies]).
Remaining platform work:

Windows: doesn't compile

The socket trigger is Unix-only but compiled unconditionally:

• src-tauri/src/trigger.rs:20 — tokio::net::UnixListener/UnixStream
• src-tauri/src/trigger.rs:38 — libc::getuid, plus std::os::unix::*
• src-tauri/src/trigger.rs:46 — send_command (std::os::unix::net::UnixStream)
• consumed by src-tauri/src/main.rs:146 (try_cli_trigger) and src-tauri/src/main.rs:199 (trigger::run spawn)

Fix: cfg-gate the socket-trigger path (#[cfg(unix)]); make try_cli_trigger and the
listener spawn no-ops on Windows, which keeps the in-process global-shortcut and doesn't
need the socket workaround. Then re-add windows-latest to the matrices in
.github/workflows/ci.yml and .github/workflows/release.yml.

On-hardware verification (macOS + Windows)

Build-green only; these paths have never run off Linux:

• audio capture (cpal / coreaudio / wasapi)
• keystroke injection (enigo; macOS needs the Accessibility permission grant)
• active-window probe

Needs real machines.